Overview

overview

10

Static

static

3

2026-09-08...ck.exe

windows10-2004-x64

10

2026-09-08...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
  • Size 1.6MB
  • Sample260910-eb5j2awfla
  • SHA256 c43a77197df60b9dc43c23fd1f1988adc6ee419d1bb8b664a6d634ecfec9f60c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 45 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 45 IoCs
    defense_evasiontrojan
  • Renames multiple (172) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 44 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\wCIgssog\yAEQwgos.exe
      "C:\Users\Admin\wCIgssog\yAEQwgos.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:636
      • C:\ProgramData\laIsQEgE\sGQMAwAE.exe
        "C:\ProgramData\laIsQEgE\sGQMAwAE.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1076
    • C:\ProgramData\laIsQEgE\sGQMAwAE.exe
      "C:\ProgramData\laIsQEgE\sGQMAwAE.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4704
      • C:\Users\Admin\wCIgssog\yAEQwgos.exe
        "C:\Users\Admin\wCIgssog\yAEQwgos.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:5380
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3232
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4144
              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3704
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1380
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4976
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:936
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3604
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:980
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4004
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4736
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4188
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3840
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2168
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1860
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3336
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:2568
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4844
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:3132
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4772
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3256
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2852
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:1276
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:404
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4068
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5040
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                              30⤵
                                                                PID:960
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3976
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:2588
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                      33⤵
                                                                        PID:2640
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                          34⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:4928
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                            35⤵
                                                                              PID:4588
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:6448
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                  37⤵
                                                                                    PID:6896
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:7088
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                        39⤵
                                                                                          PID:976
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                            40⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3560
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                              41⤵
                                                                                                PID:512
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                  42⤵
                                                                                                    PID:3768
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      43⤵
                                                                                                        PID:4624
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                        43⤵
                                                                                                          PID:5372
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                            44⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5500
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                              45⤵
                                                                                                                PID:5576
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                  46⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:5880
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                    47⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2636
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                      48⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3796
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                        49⤵
                                                                                                                          PID:4372
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                            50⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:6124
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                              51⤵
                                                                                                                                PID:2212
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                  52⤵
                                                                                                                                    PID:2500
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                      53⤵
                                                                                                                                        PID:1672
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                          54⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:3264
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                            55⤵
                                                                                                                                              PID:6680
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                56⤵
                                                                                                                                                  PID:7048
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                    57⤵
                                                                                                                                                      PID:5956
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                        58⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:6800
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                          59⤵
                                                                                                                                                            PID:748
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                              60⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:5352
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                61⤵
                                                                                                                                                                  PID:2612
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                    62⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5144
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                      63⤵
                                                                                                                                                                        PID:5452
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                          64⤵
                                                                                                                                                                            PID:5608
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                              65⤵
                                                                                                                                                                                PID:5724
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                  66⤵
                                                                                                                                                                                    PID:6252
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                      67⤵
                                                                                                                                                                                        PID:5748
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                          68⤵
                                                                                                                                                                                            PID:1384
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:2868
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:5892
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:6832
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                    PID:6728
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:3832
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                PID:7100
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                      PID:3192
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5552
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                            PID:5544
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                  PID:6216
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                              PID:3632
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:4440
                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                    PID:6568
                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  PID:6392
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                      PID:6828
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMYkMgco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKAwEYYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                      PID:3856
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                PID:4352
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                  PID:6260
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bcMocYAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:5992
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EMQIQYMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:5200
                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                              PID:3388
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAoQMAoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:5392
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGkAcocI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:7000
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:6952
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BOoEsQsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:6920
                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                          PID:6576
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:5936
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:6584
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VscQsYYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:368
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:6488
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sIIEIAcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                        PID:6908
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                      PID:6420
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sKggAYUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QcUQkggM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:2320
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:1084
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwgQsEII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                    PID:1048
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:5532
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:2872
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RqkQocss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3088
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                  PID:6272
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5528
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XuksYcwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5376
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                              PID:5840
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                              PID:2108
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OwQEAcMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                        PID:6684
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                            PID:216
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:6992
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                          PID:1092
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEIcAgYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:6920
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                          PID:3412
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                          PID:7028
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeMIQokI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      PID:6372
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:6828
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DckIswck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                        PID:6772
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                    PID:368
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RSwwIsAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                  PID:3988
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                  PID:5316
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uuUYcYgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                  PID:3932
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gCoMIkco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                            PID:6172
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                              PID:6180
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                              PID:6192
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JuIYAIok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:6208
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAksYAkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5824
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      PID:3388
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4048
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwkwscEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                          PID:5396
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                        PID:2084
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OIMcYYUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                    PID:5928
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                    PID:3288
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGcQAIws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:216
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                PID:6568
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                PID:6576
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ySIIcwQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:6592
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                  PID:6932
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            PID:6368
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                              PID:6376
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                              PID:6384
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYMgAwIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:6400
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                PID:6888
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                              PID:2164
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                              PID:228
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4512
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lSUQoAEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                  PID:3264
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                              PID:3932
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vEkUoMIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                  PID:1316
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wockIoco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:3784
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                              PID:2548
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QqgwcAYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:748
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWAswocs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3916
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                PID:864
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                PID:4948
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                            PID:512
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hIQokAAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                        PID:2044
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AqsoIsAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                    PID:2960
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                    PID:3892
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                    PID:3332
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQkcoUYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                16⤵
                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                PID:1624
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                16⤵
                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                PID:2164
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                16⤵
                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                PID:3584
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lmIoMUIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                                16⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                PID:3692
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                  PID:412
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4424
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:1776
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:2780
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XmwYgcYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:1740
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              15⤵
                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1056
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:2112
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:2424
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:3228
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sWIoMAsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:1392
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                          13⤵
                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                          PID:1360
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:4800
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:1656
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4864
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\muYkEAoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:4124
                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                        11⤵
                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                        PID:2220
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  PID:4152
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:4788
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:4116
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hKYAwQgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                    PID:1956
                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                      PID:864
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:2552
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:4624
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                6⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                PID:4264
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEYUkUgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:4760
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                  PID:1276
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            PID:4676
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4088
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              4⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:1156
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TggosowI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:1356
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                PID:2780
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:4320
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          2⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:1096
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          2⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:900
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OCsoUMEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:4552
                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:452
                                                                                                                                                                      • C:\ProgramData\QkEYAwIo\JKUssskw.exe
                                                                                                                                                                        C:\ProgramData\QkEYAwIo\JKUssskw.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:3488
                                                                                                                                                                      • C:\Users\Admin\wCIgssog\yAEQwgos.exe
                                                                                                                                                                        C:\Users\Admin\wCIgssog\yAEQwgos.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:3588
                                                                                                                                                                        • C:\ProgramData\laIsQEgE\sGQMAwAE.exe
                                                                                                                                                                          "C:\ProgramData\laIsQEgE\sGQMAwAE.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:7132
                                                                                                                                                                      • C:\ProgramData\laIsQEgE\sGQMAwAE.exe
                                                                                                                                                                        C:\ProgramData\laIsQEgE\sGQMAwAE.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5104

                                                                                                                                                                      Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                            Reconnaissance

                                                                                                                                                                            Resource Development

                                                                                                                                                                            Initial Access

                                                                                                                                                                            Execution

                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                            2
                                                                                                                                                                            T1059

                                                                                                                                                                            Visual Basic

                                                                                                                                                                            1
                                                                                                                                                                            T1059.005

                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                            1
                                                                                                                                                                            T1059.003

                                                                                                                                                                            Persistence

                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                            1
                                                                                                                                                                            T1547

                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                            1
                                                                                                                                                                            T1547.001

                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                            1
                                                                                                                                                                            T1548

                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                            1
                                                                                                                                                                            T1548.002

                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                            1
                                                                                                                                                                            T1547

                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                            1
                                                                                                                                                                            T1547.001

                                                                                                                                                                            Defense Evasion

                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                            1
                                                                                                                                                                            T1548

                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                            1
                                                                                                                                                                            T1548.002

                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                            1
                                                                                                                                                                            T1564

                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                            1
                                                                                                                                                                            T1564.001

                                                                                                                                                                            Impair Defenses

                                                                                                                                                                            1
                                                                                                                                                                            T1562

                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                            1
                                                                                                                                                                            T1562.001

                                                                                                                                                                            Modify Registry

                                                                                                                                                                            4
                                                                                                                                                                            T1112

                                                                                                                                                                            Credential Access

                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                            1
                                                                                                                                                                            T1555

                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                            1
                                                                                                                                                                            T1555.003

                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                            1
                                                                                                                                                                            T1552

                                                                                                                                                                            Credentials In Files

                                                                                                                                                                            1
                                                                                                                                                                            T1552.001

                                                                                                                                                                            Discovery

                                                                                                                                                                            Query Registry

                                                                                                                                                                            1
                                                                                                                                                                            T1012

                                                                                                                                                                            System Information Discovery

                                                                                                                                                                            2
                                                                                                                                                                            T1082

                                                                                                                                                                            System Location Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614

                                                                                                                                                                            System Language Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614.001

                                                                                                                                                                            Lateral Movement

                                                                                                                                                                            Collection

                                                                                                                                                                            Data from Local System

                                                                                                                                                                            1
                                                                                                                                                                            T1005

                                                                                                                                                                            Command and Control

                                                                                                                                                                            Exfiltration

                                                                                                                                                                            Impact

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            JKUssskw.exe
                                                                                                                                                                            • Path C:\ProgramData\QkEYAwIo\JKUssskw.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 016e6610c629336c3dd7b2ad9cab6c658f43689c2ebe52063ed908c07aa21cb3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.exe
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 32d9f2fb1dd14f21fba0d3efdd0aabe7777c74bec9c0fa8d3d627b28695933bd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 f0540083f867de26d6a338e15475372477b52c4728fb9bd379f28c79c2b78ed4
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 fc62b540ea570fef779d19054d54b8b8e001ff918d2498bc54d50ff585862566
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 69a4ec8ebdc82fdbeeffce010ab841082f216f25ba7b4f9caf9dedec0fd39168
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8c40f20cd337c567ddc7f90c548b41f852aede58273d43cf395e0bf85f43137a
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 9a08a1f2fe1e2af29e3c4ab32606523f80aac2c1710b66f46f36fdb27d82764f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b817fe44f6ec1efdcc2c0b994939546f28f9cc07376eab6c0808a46ab5b3d77d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b28e713436c9d3642c92734e06d37d92eb56026aae0551eaf1f8da9d7fb501ee
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 4859b9672e5426be1247856a006960daf3aa511f732a0382c971fdceea34b1e5
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 4801d031600853e6e4b996dce88861a81f690593b6475df89a177d9c48c88b57
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 04d9180c684a6500feb2f87c55920dd0409228742443906caa3feaff2ea63da7
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 9db7a4bd59107e659f711b4ca76dfa404327450aa9494a9dcc67573db224366e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8663bf3e477586a777743855f70070af1073f177fc9e7066204bf31e79cf114d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 daebe583857302b88f9e49ec833921587e3f427434487615d1b49e004ff089f1
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 421558a3c8c8d80304327a159ebb44a2dfe06de2a530187173155d34e1c73211
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5a1e089491fecea91b85a17fbc3f8ceeda8df02fe6672cf254bd038613b7d1b0
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 91a0ecd2448996c8848cd0b4496a6badc0de659867a83ed738f3a6a0fd4b3cb3
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 934de82b522ae251f651d6490dbd3c7fc925a0d7b8c33dce8c09012baecf0b31
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 ae4da1bcbaa493ba549e0dcf9b66e0d3132e2f467b1df912c2eb39f8ca5831e4
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 10e00b9c35a5b11c45bbc01d054d9303b91fd292c536347ad7618f8016e4582c
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 7ea153c895bb23a80e0f18470cb138a1a7cb4070f1c8c08e0374fd8a83be9b7e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 17ecee20d6cf736e36f07652e5087baf518abd2473f5a2c5aa07e4991f3e29a1
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 41867f0b51a2c323f40cc777fda8ee1034ebf5923f4fb978b89863084d62cb51
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 27792e96808a61e934ec722db32c8d808dd34b7ee637f77da2207748c4ddcb49
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8ffe66a209b06dfcb9e27426f7229ea97cc1f52005b0b01894892d9dda1a206c
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b4cd9ccb106f6c2e0fd17ef1e4964b02c639b26a82756314e796b56a93f535fb
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 1ddcc3351bfe3475604735e0738207be256548062bcf45038d029458004c5a50
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5d3893ea9546d50e65e5b3ea2e45b702c87fdc8379e382832b767b423838472b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 f06269792784a5e222bac794ba0928be6fab264311d7d7ae9b4b3d301b5e9d78
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2e5bc35d20afef3becbb457ffee4a11c0d5e7a156354a266e629773381ed6b2c
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5b75d154073f9012baf6d3a02e66adcd073ebe235b7d52cf2399cafb5168fb7e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 f7bce2f9ba7bdb1c01ff5e9af914e4196b54fa37823afa71797dc3f379d4257e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 de714086f8d76eee5e04cf1d02a33489252c9d855cc302d5b5a024b1ae72311f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 118b4d0c37a4a2e1827876ae952958ec57e482c2de8e36deed243f0fdd5cd518
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 ecf4ad23c97d516cf00654c5c1f5ed7102c80ab90e85248e57cfebfc029534bd
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 80f1cb6a4cc1eb6981faea1f5d4efc3b01e7110f5a6908986453194c678e8140
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 882e7d45b919539b353030196a4774dcc7268b3c9aa00c2f96ec3d896f00e21d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2ba2f0427590de60e64ff0c144d7b90f68a3ac4aaeb42022072c39614d4905bc
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 dd3bb8443d70f7d60a94224e1998d67e68487b73c21a9a83c4a19938d7202548
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 76157fb4c26cf26a508bc901e31a9db7f0245da3928b9f0f2c27d6c89614399d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 de38900b0b075f1a423e99f956fa5c132e251dfa15562e50bf6a04ba8672e542
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 1c0ee2e29fbb1b3cb40180097eec4d870416081aaa5012a2b6ab1f5309decf8d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5315e686a6e46ec31f1aa9e2f1e3e54e8637c24612b49e4eac952a4ea6b3af90
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2a81ced04627902c597f85999e777558c4e981cb89286c2455fd83d3079818ff
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 7405c29bce6a2efbfe85023b9ed3aca4e311e286fc11263eb19c70ab85af3b50
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 c3e2fa4cc56bc353b6e1ec3cd0c916ab780cc004fa89096a0f0232909678c5c0
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 4505702729d0cae9ffc56521bd77a3a6394b0daca9be77541a8ed44a18da9e7b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 7154bfb2ee229f7937196dd25b20e3ebaf4b516113b5eb52cfa8d1091a549c10
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 66a980d02138063c22f7a1e7bf4e4b5ed7e54d7432d17fa84c12bbed56886645
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 c530e2c82b4e1732ae16afe8aee16d05ad4749873740055b255f2d43e03654e6
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 62f506d32bfe87adb89d159b12c0342bc9aa9e9a3cbbd80cc036ca1a76808581
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 d98f6989ef9d8534a5dee1fa0e0c5c45b165ca00c0f92ff8ed6be3febbfe99ae
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 eda48a6d4ac7dfb6715741a39a40c22aa8284aa3df6db8cbd3209926934c4414
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 dedb03c79fa6b799cd1825622e4c73eb545612a70b6587cacf7b8d5bd5324930
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 91a4ec626310e088fc0318310c879de5384d6e823a35c2724bfe8587e075418f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b68fd9ac22e7c5589a3c672a8f932552cbe5005d79336ddf9d687e2cd86e8a38
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 d0780ea0ab6e1b43360253a8789cda1b4709e6f77ebbc9e61d6fea73cc977df4
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2e4f3f0af4121000471a14f113f5b550164ae9242a397bc6440abbf9a953eb36
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 cdaa29f64c7db7513865c21e02832953f9964cccd560452d723811d027d21141
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 7d27ddb905b13c82f67e583bc844a964ee815d608e22b253ee7984b7d9de91cc
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 799a5fbae25d4ddf13996db9329353ca1dba700a223baa9ec9ae1b7ed5f35010
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            sGQMAwAE.inf
                                                                                                                                                                            • Path C:\ProgramData\laIsQEgE\sGQMAwAE.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2e1b5cb8726a1253d80782359a8fef6454d5a9aaeae81e32434be52683c34935
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tQEs.txt
                                                                                                                                                                            • Path C:\ProgramData\tQEs.txt
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 37d929b189f51d7c55575daa0c6d68c6553fbb0c9679acee29401c5388c8994f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 60348204224cc739cf0b4aef935b3d8b774ca91f4609e61ca04a290d3531c768
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            OCsoUMEk.bat
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OCsoUMEk.bat
                                                                                                                                                                            • Size 112B
                                                                                                                                                                            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            file.vbs
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                            • Size 19B
                                                                                                                                                                            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.exe
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 aa5acce4f277d798fc186d7acad1193a0e68b703f90284af370680c8abd0575e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 a11e9c06182e9206fd162e556856de5121d0008f6d59a58312a4ec79cd23caee
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b58e0cb286b8adc90da79595c6c409c68b1772e88d922e639303203a72d28b0b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5d01a2659b9360098a1be1e68034eeb9331fe2bf071459110474740649997dc0
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 85219720ed0b71f962c10fbe76b60348e8ab681576411c94ab2dbb659c6f2f8a
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 26b0903516dbdbb4429d678b9b821967a162da34755849a9ee834500ae2cc7f3
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 e48babe543514eecc5e5e4522c3e49fa8dddf0b3eb88bdf4b104ea98b802f8eb
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 22cfe040132efec04e3a32b1e551b099b5e421bdaaed24fa759dd42def44516b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5230c8af7d343d3a2cbefa05a7901f742e86b8e03e1de4e015f3edc39a8b8f79
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 0ce5ec6b17b4b168983101b91521b169ca3e60353dee645a90ea57d70ab7a286
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 7861ee0f9eec6b46f4e119d24033f6a7c25d592706cd93dd6edbb118d4bc4b53
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8e89c1f62222a0386e67de93408c0c7151162471cba3fd6d6fb6edf3d84b3c87
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 bff719b3dc4cabcf86a79adfc8a9a2090e0deef7113891df6cc2da246a0ed1fb
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 fc7d42ac9dc902715332a5ccc92ae0b072e6b9fe088bde505844baca9dc4ea94
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 51e29f556248f1fe41d9a88ae9d4252da3d3f1f5eb1a14ec891fac71e6f67e11
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 3145d1d7eadfca6288eec3108da65f894843414c3c0202e623891ed7bd3ee382
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 aa13937e561933eb18c592a9aed924074372795f6b8e8511118bbfdaf67fe5d2
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 9cacc49c058610a0a340d0a6fb4d0f77d8833d1cd9e6bb03c79a63a50fcf9db9
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8c36efa323aae7378faa22690dd7577c23362550d2e040a0efed4c23e1ee3b78
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 bc085c55184fc04ce74d398d63744b64fbe257b215d87fd3bec6801ed861056b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 00133dbae26cbbc6bc14b831824728e99ceb825937e58f0916a79dcc39fe7402
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 9a1d40fd1a672ea1be4c26997054b660e53d9ea205537bccf3fcf9ad216c5a6f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 edef8df8384ce29119dc1fba6e668270582c46dd98d43f6eb601e680d56922f1
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 f3364170bb13eeee3139083791e0a9f1a4d2826850c49a4b102a4c5ea20cea6b
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 64c6fa6e92fb27c39beffabdb92e74b99a0f486d9810ba1e904106c1796c7f9e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8c838f73e3591c7f77a655927a98bf63973caf763d435ff5a25dd31e4bd7a3c2
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 baebf5bb68d4ccfe6f49dc7a4fb4dc6ad88506c228abf96b936555310eb921a7
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 64a853b0845ce6724608bf634a64a78516bc1d2f8f1613c6ef5710ad87570271
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 e78d1d89af0169f4d1003d6b8be0de7e261189e71bf9ede2092a9279f3483db7
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 cfd9b6d990aaaaa62a16a05e0870c4186c01d3f1abba6dd3bba548059415ca37
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 745a629925599346ef9e5d1afed7ac0d0f9d0d2d6d3520f8e0dc510628cb191c
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 67fe764dbd5e67512ab006a73647075988c0cc17ce53072b3d45472da6af7ebd
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 70da354f66775399db746a7c5634648d213275aadcd32c373faa4867704f270e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 5ca6fab8fb45a2701ed5cdfae55e7c2457eea05088e3be8750ec483c42206695
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 d2c84c25bbb35e40f893293e06aee952d568b1bea20786c3c642ae33f4484d7d
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 55ea56691330c2f40aea9f37ae512702e56b587c7bf6418ca77775e91af4bcd8
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 73225582936e7e71ed2222bd03a74b3edbc8fb4b4fad106d852a19c8c20d1a9f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 8c9ec1c4bd2a967d6908a009e4e22f521ec302c11f8c8e4d092d470fc315829e
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 dc5806ba1ec5335fb18a8e197ac9c713fcb08576df7719039ba5d8bb6983ded1
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 2da2cc656c57edff4713f4869c3111c6a0803f3d58e732355fc45a9a58c7e046
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 6fd6ec8fd16c5aa7c1aa015e6beb81dd1b2b309eaf04c7bc251279dff41283ec
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 086304cb793551e85b71af34c26296cbdb89130d70410ac0d631ef8fac9f4811
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 bc71dfe7c2a2e993bc4229036c3d75ff50ec9212860a6e4538fc8f6f8110d10a
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 91eb74184d4ddae4fbc33abf1fc33dbf9ad961b9f037c4071671b7b323557961
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b6d0e8007f255eee9dd3fa04c6c771ba43682d4fe56ec1b14dadeda319bda51a
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 b23757c0536893a66c3462f3448fc6b2ea564ce039fcf177192cb71133e07f3f
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 11cf0d909e85b39b5b10a7be2b1b100f5bc9ea59ff1ed4ac2ee7a0d8ac0c7f52
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 cf3ed7ad7113d127ad1bd5e05e34aa51d69029f1d2f07ede8a1c3d68c8deaf34
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 eee7a452f33891342f883166e1a031a8fb9ccaeac1d1961d6f0e6b6e42395672
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 f330dee5d4c8ddf545e771186eda611c66533a75f439cc035957bc4b39c15c79
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 d3a48073608901b9ba00eff554a756c63e53c987779e15692056879bb7ef9fef
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            yAEQwgos.inf
                                                                                                                                                                            • Path C:\Users\Admin\wCIgssog\yAEQwgos.inf
                                                                                                                                                                            • Size 4B
                                                                                                                                                                            • SHA256 142007dca2f123fbdba8abd6567ebd09f6e9989ba42745bdb207c8e8279ca0a1
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            BEIi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\BEIi.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 68959645cd67bcb2c5feaad178f0a855ad5d54d381c6a72d74e5ca2792430fdf
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            BUwY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\BUwY.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 98de9a1976b1182df77f4a0f562dddc5f4771191061f4049eaa930c541bf301b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            BkMI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\BkMI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 bba590e28be2d0ab145d3127a6f6e0b3b27666285f4102fa7e3a3690d3f8b0de
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Bowu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Bowu.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 791b5d6b18c19458519a0f6f6dd5d0fb994bd7634fbea160e50564931eb74f03
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DAkE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DAkE.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0a1068e8e3d25bc05592358386ee6dee9c2d2fdf6a16be7146ce95cdc5f0c128
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DQsg.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DQsg.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DUgk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DUgk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0ad5644238510c7f3884ab18e2d23f050264048fd1affebed0b2dce860ddfd5e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DUkC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DUkC.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 ac1fb001e539cd6aef51fdcdb085da201fa987e2d60f10b325bdf2e7d51502e8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DYEA.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DYEA.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 33a2534fb31e13434b02147d1ed2d870e9a025da5304d5ca714140fcb42d8ca3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DYMu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DYMu.exe
                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                            • SHA256 29f8b4f044886af9fa18f6290849a76c0b42da223f3c213aae5817c8969b27c1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DgoG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DgoG.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 8b11f00228d4c8945d83c3e8b92f86bb5621dac0a8e36be002161b7c5c1c9a47
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DkMG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DkMG.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 4bb4dec97fed21c1c3d43803191d3925f5d357bb2f4fa37b1758da57451897c8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DkQM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DkQM.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 9fc39bba20be150cac8d7088cbb69dd2dc1543f5bc3299e5cce27bf3812f1a62
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Dksc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Dksc.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 61773a10ac8ba40694a76029eba6965e76103b759eabcd17c0894e582492017e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Dosu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Dosu.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 fb9e727d4c76cc8261f154290c5cce24e60234418135073c8bca59746edbe06a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            DwEa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\DwEa.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0da8d8925a3da73128ff96b7f123cf8f61f41f183cb914ed02adbf6167486df9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            FMAo.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\FMAo.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 6699f78f72ee14abb4f4b679eb4b368fe0636597909de97bd8ab7233ccc2c1d6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            FMQI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\FMQI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e515072c8a5dad956e99d34424547498be7231a2ecd3be11924dde8b359ebe13
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            FQgC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\FQgC.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 68528a6c972bd3bf2ce97d31194b6048270a6cb8e26e8fd1c71cbbed6d43b178
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            FgIO.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\FgIO.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 2cdd3b71ad597fb701b6323edf6dd57433caa6cd1a1beaf4ea60155ffe055b08
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Fggw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Fggw.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e62748f558d48dabc8f837ab37983196339bfdeda10167d070c80d1cc032bf82
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Foky.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Foky.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 15854284e732cd0e24aa52c40892cf3e32ec449726c5d25c2511d86e48d101d5
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            FwoI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\FwoI.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 0b64fa2547844896073ff438b81cd688460bb6301759652740c537ec9065961d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HAcw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HAcw.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 25041d884216db5c490665f2b11774d7d3b99c50086d7f12540344e44446fefd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HAkO.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HAkO.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 82998f498f87f4d6d0f68c351c4baa9d29df3fec6da6c12789d048ada62c146a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HEQi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HEQi.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e8ace2bbf247662e0bdf26f7aa2786ff2973910a198be72c59027df7d92d71af
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HMIk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HMIk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 b9eb85679daecddf79e745f87919d3bc30298917c88e31e92fb70ec8d89751cd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HQEm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HQEm.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 673c158cee43c7d16b2e6446fe07dbaf6ad9dc027711e2bcf687537886b9929c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HUsc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HUsc.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 29be0d3c4621f463f71db7eca4f63499bd6467cee3eabb0fdb462f3fb5922ffe
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HcEW.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HcEW.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 c162bc526359c7ff04b66f4d8f117eeb54d7f1e7ea889609d5506a8284f7ca60
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HoYK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HoYK.exe
                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                            • SHA256 b015ec67370a6efc54f63f9a7e28c63a7d1fb7ca47b1e8ac126f89daed8526b2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            HsMu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\HsMu.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 8ef12f8074f76a6f18c78f736a768e57c8fe2f9632db9280b80fc3bb9611b1fe
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Hwgo.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Hwgo.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 dfc1fa77c7f47dde1fa0f3422275f181c572217dbdea7d68df4b8995e02bda1a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JEME.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JEME.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JIIE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JIIE.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 3fd2ee388543b2d58155e80b8759e77eb7acc6b7521106b5c55075e3c855aa64
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JMwu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JMwu.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 967c286a357dd5e2d7d97f6339062178550f3c6ca38cf689fc0e3a09fe919001
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JQQU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JQQU.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 f596cdac31a99b2da8e108ae175affbebfc81e09444de1daa2e14dd1890bc7a0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Jioo.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Jioo.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JsIa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JsIa.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 fd4bdc3a20e7b2df3bcf979934e9651648e96d6ce302dc3749af02f0f415672e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JsQk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JsQk.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 8e7579bfffc642c8cb122f2434f65fcbd7ac5e47e944a79d0d0a27e291364c41
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            JsYK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\JsYK.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 08d35ca088588c3b14440d29d006ffbadeb5238e1b31e855d4e80ecf25d69bde
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LAMi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LAMi.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 c7d95dc1b1baf45f2702409c5474b38a49bdb752b71a729fdc37ee0a42439381
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LAkc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LAkc.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 a46f8032b0889e625f3000542713b86b4144db8022380408242087a46a010cff
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LEAm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LEAm.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 269a9dbe73d41ddd279c7600c4c2bc6ff068973023c38f968327d4f0f5706af1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LEoC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LEoC.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 ad85fa76779c37b513d67c97b3adad429896817ce2e9ee72db90ff295d1d591a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LEsg.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LEsg.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 be3e79875f3e84bab8ed51f6028b198f5e8472c60dcedf757af2e1bdf2aa5742
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LEwS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LEwS.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 570ac1e15615c032a7c4d7ea7e86c1aa8ef29d0f5f47e27100efd0844c3ba569
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LIYO.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LIYO.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 6ba4e16c8130c053de8f1171e1b12701159f9677f51d6f2c1dea626d5fecc740
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LQYm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LQYm.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 c8d0be6c9e6ad452b2743a25a12ca29abd92b4b0c317c0c72de3446ecfcb4a5a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LQsG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LQsG.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e370bf5c069d6777b8c30b50b62322ffa3e4324a619664e1d711efc08d6270cc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LUsY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LUsY.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 62bb2d122b810b24a1e62d12b1179d037cea46d1b618747e5859c75b08a2e66d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LUwk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LUwk.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 28d1eabd768add8424975baa36b9671cf0f82eeaa246ee89780d357dfecf1f61
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LYcu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LYcu.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 87da69fea7069c49b6431aa62d4f7db58dae33f50dfe83c38a5a319be984a272
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LgME.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LgME.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 8ff586046524d3cba15c9676011fa4beff523d6f9d8442d1d41335c229b39e53
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LgYu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LgYu.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 49b4bc6f8c9e1cb8c7a14241b863772036a3ecb5cfd0ba4e2a78163c5203e71a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            LoEs.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\LoEs.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 da4d2fd25f4cce489fa37a8de562efaa92be2a26ee492e92fc3033f3a9dd58e9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Lwsm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Lwsm.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 5a85dda1b87665bf1158ffb984a13c28ef2480f98fb7ee635f073497e7bb74ed
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            NIwU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\NIwU.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 638ff8e67d0220c690d19ab5294faaf71b3338d3254baf41d4eaf62df8413b3e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            NMwE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\NMwE.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 ce0361c902c40327983cb67eaadfc49223302c55458ca2d60d7af16dd2fe16ff
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            NUgE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\NUgE.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 03d5244b04049c0773200d35f12f012c4a4e81df099371d2f02f74d646532b2b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            NUgS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\NUgS.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 0ba982de71192bb4904d5ae919170b6754e9ff90a40750edff45195f1d25dbd2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Nocu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Nocu.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 22f97a8063a4a5ae00cdac095b016355d9b4c038d209b0534a7859984a033174
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Nsog.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Nsog.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 233648fca330cebdaaa1dc6d13f5c994d5b3086c71a7bdad179b4c9eda346718
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PAQe.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PAQe.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 331c529cb5acc9ae8798afef94370fc3a563a8c7de39d985c8addc9158d244c0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PMoe.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PMoe.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 7b22165a3733766bf276ab1d2f215a2b5b65555d3776716f4d9d88bc19d1c9f9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PQog.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PQog.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 3b271d43b751fe72aa72a8d07c928217a9857502de491040fca27cfb3c3ceda5
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PUYI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PUYI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 fe27256da30fbefed032e95933b5c053e03a16f3db890f8b2dd859ff331efd8c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PYYI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PYYI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 2f86098d49a3d1639f184b15f84d10e2e882eaf04cc59d3bdfd62ab577dae085
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PckQ.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\PckQ.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 b044d20c3b5eac35b02ae43ba59121cf0cb80840ec9755709558b82cadb112ba
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            RYkw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\RYkw.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 820963e0b1d891c702019de0483a7a87f1e04695da6e895047cc9a52d210a41b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            RYwC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\RYwC.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e40dd52e171c2442beb76cf1a4a64296429f863767107c2e2a517da2b0abb265
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            RkQI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\RkQI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 a27355ad48264bc6be277cb0c2ca78642960c5151252ab572e0168add5de892c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            RkcA.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\RkcA.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0de14636f1027cf9b050817688e45bfb76cda5b884421c8c095535f56fc18bfe
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Rqco.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Rqco.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TAIq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TAIq.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 9c3b8b56ce8d2c80a52d80bfae32393e76cd9c8c641eeac9f8959d57205fca76
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TEUg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TEUg.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 994b3e848f505075a46a6ced99243727625e95a68807bf9507711de22fd7d602
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TUAg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TUAg.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 b785715133e1270a96a694ba1dbf858ef31648138ded377465bba91f636fefcc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TUwi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TUwi.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 e7b7570db9464196ab4639d5bb219a5e574812c4e7268806c23edace1fa3b859
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TYIk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TYIk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 a29e2f15d19c6a822e9e53e372cf9cf11b74de22a679848e2a1aec2624f00a71
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TYIy.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TYIy.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 d441b90954b8e798ccd9700057bf65d3261e1783c79bcd78b5ffdc7657e506c4
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            TsAy.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\TsAy.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 0566a4395f8c44ced7a27b1ffa841017661b1597fa41243b6b4a31f894c7dcc0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VQgW.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VQgW.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 bdf94687ad9da4f828b4e70c05029110f091746c644dc3ba8ff0856655971054
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VcoC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VcoC.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 81fb9a9c352162f561618263d4b991e73b2c1c5a45bd14d902bea248ff322c57
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VcwA.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VcwA.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 19d5d36e1cdd94e68c0e0b38bf3f0a9f249e653a0bcc06592ccd3da712d3f1e9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VgQI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VgQI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0b7d5b88b21469f3d51b642386fa2e953fe4e17709fac95af5dade2b8be58491
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Vgou.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Vgou.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 0d033759dd51dc4eba79e48c97da90f185cfa5f677303d9b59bf38123f6a3ffa
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VsAe.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VsAe.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 87f43a7c0d6cf804cc75f9e5d1f418ce89e00421d5c8c52c341915e0b058cedf
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            VsEG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\VsEG.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 78fc549823cc6cde004740faa83a26cdc3c837937ac69b032040f5fd59f68871
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Vwgc.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Vwgc.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XEMI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XEMI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 04f5f392d6f0b323c4a9d31382308d3d5e26ad4c66f75ceb828e318b17c3ff5b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XIcI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XIcI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 b579b713119c0c05b2f5c8252a276a7ae2f236c1bf2c1a3010fb4126bf4b0c17
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XMgy.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XMgy.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 9a41b3555769ed911c42f3d0e097ad27f56fdb27e39a7aac9f57ea58dd6e022b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XQIE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XQIE.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 5eec19a845336f0b600caacf484315846c5f45b3417663fb0d5f9a6dcaaffdd2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XUMG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XUMG.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 c21acb51b1a58a0bd21caf7e2f0d49c7af09284b6eb9b8de8b1e314b4e4bd585
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XoIq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XoIq.exe
                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                            • SHA256 df672684e06f2f257a514456aa874907c761759f1aec6631107749d308ee7ce7
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            XoMG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\XoMG.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 e08420396892e5ff0b17a143bd4cbc8bc528cf61cc8bf81b69c1bd1b92b2dff0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Xwog.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Xwog.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 dd6bd5fdb0b52874871e5b6e28f187d880e87fcd5c70820589cfc47d7de4756a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZEoa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZEoa.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 b557f635911a32353924a576cae278ed294233921b2f21c2c93caf1dd30741fb
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZIIc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZIIc.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 8a8c8cc4326afaf0a03a1da6f0267a9cbd04673ae6c97f5772fd962b150ff076
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZMsG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZMsG.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 d94aa9a10d089f518f541c60517a98538214c52acbd0b849c67d20bddc81c0af
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZQQg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZQQg.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 7a8ac75e9174deae803eecf53861b7bd5da96a1bb6dc77f466065c086acdd842
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZYws.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZYws.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 a27443fa2529e5a29bb1e4135636fcb110bad0926a52cf20414079616b5e86b1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZcsK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZcsK.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 de3eb7f6cfae31a375a4850862998d08e954296edfe736b2bfdd5292bb9d8644
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Zess.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\Zess.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZoEc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZoEc.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 925ed2302a206755640f2e6b8bd5f68734885c5b8900175399761b18ed4f6aa3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZsUK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZsUK.exe
                                                                                                                                                                            • Size 2.8MB
                                                                                                                                                                            • SHA256 f42e5d3d721bee1c95a110954338664e89b401cb7a6f7db0589b4dd3d9aa6261
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ZwYq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\ZwYq.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 111f7ea3c0229499b1362235d4b01d7a86586584408fb6903b648189401b48cc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bIIU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bIIU.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 e51b961101d3b08c95ccf4b10d5bf6782b3e17cb9d352cc8b465f1aeb0ccd625
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bcQc.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bcQc.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bcYo.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bcYo.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 1b33b598852d7033282728a489206d4c5c543de6aabab9b1bea367178b7ae3ac
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bgEs.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bgEs.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 c63524e1b8cdc63366040c5cca913072757d6b512eacabf70dda22523120b7ff
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bggi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bggi.exe
                                                                                                                                                                            • Size 3.1MB
                                                                                                                                                                            • SHA256 ca8d9adb725b0f5309369fed0252b8380415669f59a1a1df44d57c31e6fca15c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bgwa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bgwa.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 784e18b1dd67684196d8e9ef4b34a9d0467951969aaa7f1ba1f9a40b58da7adc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bkwu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bkwu.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 55e75b9a68e9507f37c62eaf10c3e0adb4924eee9ad33ccca02eff782df28034
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bqAk.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bqAk.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            bwcE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\bwcE.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 12218d2c87e43c8a35ad8fe46ee0b25954cc9ca270aefeda9b4ab027919b58c5
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dIMk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dIMk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0a80638ed0cbcc26b1937ba6907bb964bfbb32255e125635f9c7c09e5e829769
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dYwI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dYwI.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 6ef6c4bf18cbb49499eb4a57b242b78376556b6e1a878433025597b5c836e74d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dgES.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dgES.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 3ea6fc02695df492bc4e2b9fcd279f3aa6e195ead16b3f20e86e52ef83670da3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dgMg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dgMg.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 01aea28830e3770d2037722dde510315b5ec751f3b80c1f04d9cf45cc7521530
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dkwU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dkwU.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 7b7ad5684e3dbee287537c977290e40ad3955a1cafbd038f8a87d374752a51e8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dowm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dowm.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 d3ebcab3a39265d56517f14d477075584e3573c84053af7410a6099f3ed02555
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dsoC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dsoC.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 beab7a214094bf71fec9cdee0ed01eadd76861057b44d6e89dd654033da4846a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dwsw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\dwsw.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 e7baba570618e6a648f4a457731ee81060bf3631379273cf4625350b11d9f21d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fAkg.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fAkg.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fEIi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fEIi.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 b240770f56089407909a80625939d3d71e0ef0f124ba16e798321bfa6974e595
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fEQm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fEQm.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 606190d166a06c30d57424bec45b86faaa5700e74bc66244f9ce2d8087b6b72f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fIkW.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fIkW.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 4daa1c9f9863ca05d3c334abab889577867e5a38574a685f064bc03b08306c1d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fMUM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fMUM.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 c79e04e2268466b08bdf5f93a71d02af9ce4c543d7f86fb60d4fe3d8c053f444
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fMgq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fMgq.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 a555a09904685f0ff88e81a6313986cc60bf8f06faac34d71051c17cd6cd87b2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fUIQ.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fUIQ.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 9c4c962bb80e0edabf5db98c4bdb63e86c462c5305d1663b41675e996615acd2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fUsG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fUsG.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 6944ea7009f81b2cece0e27ed4d422a3d25f94c704d7cf84c74366de72e1ca42
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fgAa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fgAa.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 6d653db0966c4a82ba8e71d6435a028fe3db4d9dda0c69e3ad8919c6a5a128af
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            fkES.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\fkES.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 3a860a9e14b874f2bef041f26c97939a788dd5019f556a27a1cd9d507f23cfe3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            foYw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\foYw.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 1ef84c00c892540d2c69abb34ae60bd733f82c024e8a4c44172f0d7df47f9413
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hAIY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hAIY.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 79ac922a5995d807facbbdb4ddaa702ffce139d17ea7285373d076e693f84345
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hcIy.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hcIy.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 d726baf6403f88d04079d3874ca82242bacc94cb19a3b63e8117f43ae03154d0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hgUS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hgUS.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 3af79a279726daec36727a37b5af99dd27988ebe980e7f000e52916a2af5c283
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hsAq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hsAq.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 66d73d7fc23609a48e5986298d4f9e4c8dcd1c9460fc6f1ca2d4f4fe120c8d25
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hsoG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hsoG.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 a9d5bf849d6eb3561cf98ec527ff3e99f5419875b2d7162872791be06c292ed8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            hwAU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\hwAU.exe
                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                            • SHA256 00ec8d3ff3f64797f19c086307b98c28f7d09b9e8ee231ac64e6d60fc6d8e6ba
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jKEE.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jKEE.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 9c9fd45790fe956176aeab743484780b62f28a6dcde6e85cb6c6279ff3323b16
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jQES.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jQES.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 5116a2a342a3d0b79c3570f7a853e6831eebd3c48efdd649ed6a604ed32ad3a3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jYkI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jYkI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 324a741db6d6c320744f17b1a985c32db471fe43a5ecfcabf5b651353006a993
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jcwO.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jcwO.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 d288811a8bd766cc0bd8b77d566b7ce3d3d51a187cddff4e70d7b36f504eca5b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jkce.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jkce.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 0d008717f7cd77c133dfd08418e967284dce1f415606d136134db5bc44dd80c7
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            joUc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\joUc.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 8872ee29e049d1ed8436a89cfd5e4cb08dc82f0b846337a1df00ba2fffd401b1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jogg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jogg.exe
                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                            • SHA256 dbb9fb51ae710fc032374a2c7d7278d892d7f4798f4ae2555b7d6b38f13cf132
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            jwAG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\jwAG.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 1c818ed5fd1a441c167b3795657422a5634fe5b31719c8a35c4c04ea938a826e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lAAM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lAAM.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 fcd4fe75c57b3b118dfdae25ea6be29357d3d76c7b943405f6d3e6842cb9fbec
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lIMc.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lIMc.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 c25686608ab4017a4beed073afc0416b2156afc7dbf8accc7bf876d375ba6c84
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lIog.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lIog.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 8f1392167fb45bf120d2da29803c1f84354ba76e861b7f5654ccc2f2d57aa283
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lMUY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lMUY.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 44b458608e5732a4156a88fe78731c9a1157cfb045bfd1ade6a5d3c6956f454b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lMYi.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lMYi.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 58b5fd8dcd145d36fbdc3503801c2a543b37416c533f61245aaf68b9c2db0c4e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lQoO.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lQoO.exe
                                                                                                                                                                            • Size 2.7MB
                                                                                                                                                                            • SHA256 498dfe2cfe8d992cb409044f6c56cba71e12a4c1ba819b95ee786958f29e8453
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lUQK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lUQK.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 674d67a73e7dbea833918c7a67e7af05f54e50623d377bdfdaf57f892b80aeb2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lYou.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lYou.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 2ad575fa88451d201c30ea0f398dba31d7aa59802c7f756a7c944b80d513fe80
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lgwI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lgwI.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 732ba56aa5dad05c2ea489d862f157b10b6c5d51192c3ecf22a40f4b8db7b427
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            lwYK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\lwYK.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 ff903be338ea2ee42ae75f9035a00305b96fee43cbc37ead6edd5aee840366ea
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nAEU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nAEU.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 50d27c87dc9fb4d47e00710ca357b5c1d2653a85bfef577ff2d2e134921ec435
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nIMu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nIMu.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 bbe54551a700a7ee121d6dbe4cf3842674f7c8227447359c2bbe2755ab54ec2c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nIkM.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nIkM.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nMQM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nMQM.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 4c0f9dd14cf681562368a38f98cfb3e77f3d08ce5bc104af041a1edcb069c660
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nQAm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nQAm.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 e2375b70aa5bbcb3afe00c94f1b3479ee4f19c7a445bd2842e6b53fff2999c73
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nYwk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nYwk.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 d891fd6e96ca2803bfed91d594e240f28f6f2b57a9c6d105a020aa32918ee03e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nkgq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nkgq.exe
                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                            • SHA256 040a54a73cd56ea690bdd57e6e9bf69c5e3c5b97e84a784193d1b2394669f145
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            noYU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\noYU.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 08b80eff84befa1c9757e4a8683cb5a79b3b35094fd74570ab65dab5a83c4463
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nooU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nooU.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 23612b86463b1379642ece45a3f8b3e7d4c94b825970000ced0426033bebaece
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            nsIS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\nsIS.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 d1e38b5617020ac2a575bd5d1076babcce82a2927662acacc8cca9840af5cc72
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pEcy.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pEcy.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 3cd25fee23b461d20e72cb7499d770435ade35f1fa074c55b5d4322c49d94e57
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pMsa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pMsa.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 4d6569ef54843076936e8ed923e8eb0a614f2c2a72a3962cf03abc1f2f327a62
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pUYY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pUYY.exe
                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                            • SHA256 1c3e3d77a4e8658ee15b6d0fa7b1d0c990d7daa93e38cc0e79b9ed82b33690a9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pWok.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pWok.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pYAI.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pYAI.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 d70b7ee6facc422857c87e3b0e44eba7ada70e9077f50228574f8e5fa1286f65
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pkYC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pkYC.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 3870c628885556b4661256c7b5e95bd50ade61ff3590a0e34141565b18d91cc7
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pkcw.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pkcw.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 9bac200c70096760d46543f907341daf142f0062a3cb0f8a9ed62817e7d42788
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            pkoG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\pkoG.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 f9f423b5427d5219b47a91055567d4a2eb3bf09b9e158bcf3acb60e1264bc988
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            poog.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\poog.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 47a5c923c2455ebde0583b5f340e633aa49de8e3e5dbe35c13778574978b931c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            psEm.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\psEm.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 6c0c4d16d57f10c241e562824fceacce6872cd2b4f32538b4526fad104ded8fe
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            psgM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\psgM.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 5c6e48e8cc194b3c4dc8afcdbbb23ac3e82e9f805a51b753c292c34356882f9a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rIkG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rIkG.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 591bcd8453081141482f2e7d2783fc9c984a9884cc5c422b28f37aefed2edde3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rMIe.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rMIe.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 190b856805aee735f7f9ac4a6810ffa7cfb8f0bd997c320175be6f9163dbcb6b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rMkk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rMkk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 d999590384bf5b747cfc5b60f105c32e0ab17f7f1d5543a70c1357b8cc568802
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rOkA.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rOkA.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rQAq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rQAq.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 3430cbdf4555eebde811c35d2ab5fc4b583fbfe075869eaeebfefe16203b3b9d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            rwcu.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\rwcu.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 10bd87819645a4e28e252981d6177724615fb21db5f9c3ad9926589cf9a2eae8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tIIq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tIIq.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 7616347382c8a7647cc52b0ed0f1c48d5973891e066416f3a7a9306dbbed5f7f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tQke.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tQke.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 b95288bbd2f0adde027df15c83dac7ded34be0fa9056096970675678da2236c6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tcAY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tcAY.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 616d2fcb52653bdfe2c719fa0b5bfecbbcb59ad94c68e763437fd3c1f350e968
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tgUg.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tgUg.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 5ce2b41158afd3398dadf172b754d475ae5989552a226a69366ec7c48c82f6a6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tkUY.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tkUY.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e928881b526dab5e0e130f685a47e8f50ff039c9fee1c7b6be213d081e7cb6b3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tocM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tocM.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 76970bddfea48401e24d128538487ec2a2319672b32957b5c50c0a1652e1d550
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tswA.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\tswA.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 c92d10c878de6e3a613aaf1e0b43063418ccb8126567ea8c579181fa705ff293
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            twUG.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\twUG.exe
                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                            • SHA256 bebb82b906000c364a16d7d911e78180c7fb75fe6001063c154fe27f51054527
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vIIM.ico
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vIIM.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vgMM.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vgMM.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 3c8bf6ccb2666ba4f8f8f9768c4e2553b4b818dd281816ad962cf22220244b2a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vgYa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vgYa.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 9b3e1fb54db50f5ab2bb6a10f6a1747074198f91155922c02b1a3544086f1922
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vgoS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vgoS.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 82a3456aeeab318adeacf3686abaf8e21301de153ee34a566fa9eab2ec8f1f97
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vkgK.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vkgK.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 e5b20185a58d493dc6115120ee721948f631a346fd2753dce6e0b113f0330efc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vsQa.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\vsQa.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 50474d4a5a558e46c6e4b8ef97f460e6d37f1afa5f0764008c5f7fbb711dba26
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xIIE.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xIIE.exe
                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                            • SHA256 aa3cf7fd431b30751120aea9085e354c941ccdfbebff24b77bcf79ef58469a0b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xUga.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xUga.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 67ae4cc738cd008ca521c7c1c4168899348c73400cfc081f8c0a0a15d96e8453
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xUsq.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xUsq.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 9dc605f13bbb0f59e54b8acfe4abeb70fcb37984c2523d8d8eb75fe14fd2acee
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xgES.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xgES.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 86e48e9ef6540ef920904134018bf3a04991a4737e113e8b9dad3f8415849cf0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xkYC.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xkYC.exe
                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                            • SHA256 b49de4755f6f8998140094cbf9304b3d9dd3e3a203cfee077a4db3c9a0d9f1b2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xoMs.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xoMs.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 73c79a264f8ee75dc26504f774da8e589c2bd67f8f83460816851649e53c47c3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            xwUS.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\xwUS.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 df6bc014f2c985da413dd5ffcc05bb597460488cf7fb2cc654be4c85b2f44eaa
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zIkU.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zIkU.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 0c102f252a42ee7bf9766a918542b5bc4121ea1559dfaeaabfa398fa93333f29
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zMUA.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zMUA.exe
                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                            • SHA256 7268f295f05397fee768fdc7dfa82e5678cacb0f9aa80a599c785507a784becd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zYQk.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zYQk.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 d6592a9e0f68de70a2268235c98a90a9220244d63ed37b6dd8526b544aca3ac0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zcEQ.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zcEQ.exe
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 74655b76dd449708aabf1e0ddb28ac8a7644877a78185d486306e190d6fcdcf3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zgow.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zgow.exe
                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                            • SHA256 5b19758bc9e089fcd88c84ec2ef3a89c2592de9e8e11646a0396f4def5452e55
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            zgso.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\zgso.exe
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 4aa75dc35c06299a7b6444b454ca2202b8ce877dbbc2f371fe98e281816d4f27
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            memory/404-204-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/404-212-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/512-2735-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/512-2719-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/636-12-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/736-1-0x00000000021C0000-0x00000000021E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/736-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/736-26-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/736-27-0x00000000021C0000-0x00000000021E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/748-2823-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/748-2836-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/976-2713-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/976-2722-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/1076-2732-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/1672-2789-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/1672-2799-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2168-144-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2168-133-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2212-2792-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2212-2783-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2348-2883-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2348-2898-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2612-2833-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2612-2845-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2636-2768-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2636-2762-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2640-2694-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2640-361-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2852-203-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2852-188-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2868-2886-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2868-2878-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3192-2938-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3192-2951-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3232-49-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3232-59-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3336-155-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3336-145-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3440-2920-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3440-2929-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3488-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3588-31-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3604-90-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3604-99-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3632-2979-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3704-60-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3704-70-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3760-28-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3760-48-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3976-332-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3976-263-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4004-115-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4004-105-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4188-116-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4188-126-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4248-2971-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4372-2769-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4372-2777-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4588-2697-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4588-554-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4704-13-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4772-187-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4772-178-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4844-159-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4844-175-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4976-87-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4976-71-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5040-273-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5104-33-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5372-2746-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5372-2739-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5380-2718-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5452-2854-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5452-2846-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5544-2961-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5544-2948-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5576-2743-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5576-2758-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5724-2866-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5724-2853-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5748-2876-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5748-2869-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5956-2813-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5956-2822-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6216-2967-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6216-2958-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6680-2801-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6680-2812-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6728-2904-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6728-2915-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6832-2907-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6896-2711-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6896-2699-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/7100-2930-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/7100-2937-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/7132-2710-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                            Download