Overview

overview

10

Static

static

3

2026-10-01...ck.exe

windows10-2004-x64

10

2026-10-01...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/10/2026, 20:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
  • Size 1.6MB
  • Sample261001-zh55csszhx
  • SHA256 b29611864c9482ddfc6a19878d40970463740401121d7a97f653e23dc1155bea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 63 IoCs
    defense_evasiontrojan
  • Renames multiple (121) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 7 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 62 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\icAQkQos\RoYEssIY.exe
      "C:\Users\Admin\icAQkQos\RoYEssIY.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:4688
    • C:\ProgramData\lasIAwwI\geoEkMog.exe
      "C:\ProgramData\lasIAwwI\geoEkMog.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4336
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:420
          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1456
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1716
              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1820
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4404
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3384
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4340
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3572
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5016
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4500
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:5072
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4932
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4852
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2716
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2096
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:1232
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1756
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:2056
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4724
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                  24⤵
                                                    PID:3820
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4044
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                        26⤵
                                                          PID:4088
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1960
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:212
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                29⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3220
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                  30⤵
                                                                    PID:1196
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3972
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:4736
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                          33⤵
                                                                            PID:2692
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                              34⤵
                                                                                PID:1072
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                  35⤵
                                                                                    PID:2068
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                      36⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:1200
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                        37⤵
                                                                                          PID:1260
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                            38⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:2752
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                              39⤵
                                                                                                PID:3356
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                  40⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4372
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                    41⤵
                                                                                                      PID:3896
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                        42⤵
                                                                                                          PID:1292
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                            43⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3752
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                              44⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              PID:2808
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                45⤵
                                                                                                                  PID:5004
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:4684
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                      46⤵
                                                                                                                        PID:2760
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                          47⤵
                                                                                                                            PID:3876
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                              48⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2256
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                49⤵
                                                                                                                                  PID:5232
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                    50⤵
                                                                                                                                      PID:5200
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                        51⤵
                                                                                                                                          PID:5300
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                            52⤵
                                                                                                                                              PID:5668
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                53⤵
                                                                                                                                                  PID:5956
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                    54⤵
                                                                                                                                                      PID:3660
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                        55⤵
                                                                                                                                                          PID:3360
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                            56⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:3284
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                              57⤵
                                                                                                                                                                PID:3740
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                  58⤵
                                                                                                                                                                    PID:5692
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:1816
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                          60⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5420
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                            61⤵
                                                                                                                                                                              PID:5900
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                62⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5560
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                  63⤵
                                                                                                                                                                                    PID:5924
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                      64⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5796
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                        65⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5264
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                          66⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:5408
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                            67⤵
                                                                                                                                                                                              PID:2932
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                68⤵
                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5268
                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                              PID:2896
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1272
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                    PID:460
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                PID:3436
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                      PID:3816
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                    PID:5588
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                            PID:5708
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2076
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smkAYkMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wyEcMMYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DqAgEEIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAQYUgcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUIkcYYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NiscIEwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GmQYAwUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OSgwoUAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kCsYMIYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIAYcYYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VcIcQIIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZcAAUwkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCswccYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CSwAokYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wcMkwggs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CIUUIYoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uacsYgwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nswowwgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NGQcAgIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qUEUMUUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cSYwEsMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CUgcwwYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCMQUwcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rkEkEgcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MWYocAkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yCYEAEcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:820
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uYAkscow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hUEIAEUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lmQAcIYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:5516
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5964
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VQkwwIgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5568
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GuIQsEcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:556
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:6000
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogAEEIkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qiQIIcks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2680
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JMowYQYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:5880
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jqAkkogw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jSAocwoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:416
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SgQYkQMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5968
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uGYAosEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5384
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:4356
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vGwcYYMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mcQgAwYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pCkkkQIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3672
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:2160
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:4392
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KckkAEUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:4160
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:4324
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:3620
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nQEUkMYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1520
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GEMkEYwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:3708
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:4120
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:4372
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xKswcoUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:4508
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2868
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQMgYIkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1112
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCcIQAIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oEMcYAkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:3284
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OscYsYAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:1752
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:2808
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:4120
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RwwAgYks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3440
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:752
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKoEsIAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4752
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1260
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wyUkwQMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:3564
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:3864
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOgQQkos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:1664
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:3804
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bIgAYEoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3284
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HOUgIQQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tiUEMkMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:648
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:260
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMYccwQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wOIIEEss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:3808
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:392
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwAIAoAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2472
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:3696
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xcsQIIAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\guYsEcIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:4024
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:224
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3348
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISAIgoQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                              PID:1676
                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\QcoQwEsQ\awMEgUAc.exe
                                                                                                                                                                                                                                                                                                                          C:\ProgramData\QcoQwEsQ\awMEgUAc.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\icAQkQos\RoYEssIY.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\icAQkQos\RoYEssIY.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                          PID:1312
                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\lasIAwwI\geoEkMog.exe
                                                                                                                                                                                                                                                                                                                          C:\ProgramData\lasIAwwI\geoEkMog.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\icAQkQos\RoYEssIY.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\icAQkQos\RoYEssIY.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                                                        • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:1840

                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                                                                  Visual Basic

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1059.005

                                                                                                                                                                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1059.003

                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                                                                  Hide Artifacts

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1564

                                                                                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1564.001

                                                                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                  QWIo.txt
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\QWIo.txt
                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  awMEgUAc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\QcoQwEsQ\awMEgUAc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 68f97deda7ee832be0f54b679e3d6d2fc411f54e3e38b4337db4c9076289dad0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9009382e28f3f86cbf79d0c44f4c232da052f010c5810d51aefe116db25a23e4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 11260bfe089879e019b1d789ce32a1d42f8405e9572f498d885056d956fb2fe8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 caf63666b95ab39bbb4c948da5d0e4c0fa213c7c373f57810e846284acbb8d44
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 7cf0accd74f6d70461ffa02156346e8eb149abdb255f67e7d22b4d6778ec5ca9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 69e216cddbbaf7d0de384b847c82019bcf3ac9d2f2eb50de77e7470f66665a27
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 9a32b8d2fe796c5a398928366c4d5c4dffd7923f40810a8a878ed5189000c451
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e78e1ba7207b66d6b908fec2a432c2ab1089cf37856f24acda2894d128dea3d9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 57bbe1ac1e82c2ec38d91915781b858cd6b238d080ea9abda2a3254d84633b3e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a18c483caa578ebc711bf4d79083f262d7244d0a837db10646881a9b8f6cbd3f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5963e7a0d589986b2cd5925c1a8cd4121305b6cc2fc7ef059360f96775288af2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e04d696faf9459dc394302e066e5db510d4048b881f1aa78d7b5a3a75473d94c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d9803febfc1e912a59d96bd0441b16ab839876b0d335968c4d86a7e3cdc3c2ab
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ef7ac96524f467553b051efb98b263bcb8c9c7a1ca9e99d345604e0bdb2867c1
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ec2aedaf6c0c240bc8d6ddfd9ddb7e111eb8aabdf5169937c0a33783fd848412
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5d7617e791db08a9d7ca2b99a11f2fbbcdb14eb312e60c57c5c1f60bf14331fc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4064b461c8f47cfbe8063a738f55cbbeb07a132e547f8f078404924d4fd1ea26
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 721ecb321abcc803402a0c59a69eff45787fafa621f85e32c9167b778b6585f0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 18659756ffe42e9db4d9c7b3dfa36e6e7db2344d3394abf4b5b1a6c78265ab2f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ab9d7e93b5e5190578d750ab467ff28a3c68f40ac0dd930156ef9fad6d7fd549
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3d9ec952c81079ce1fd9ca594303e3d471ad523836be78dceb9d29244e27bd45
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e1246b52f3d75e028bbb40a96816c2dd297b3dad4cb0018a1646455d30d479b8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3902a322190dc0bd9cd2af24535f17c0288edec1e83b30492c592c1159063dfd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 bbb9133b574b63901ace5b3764dce161fc55e217943a02573d9ba3e85b71daa7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 cfad1e143e40655cf0a4298b93a37a5635b5468af9e074f989887bcfceeb929e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5828fa778ee78d03c999f838d4bb148778c6ce2fdafadff946adde4e197e0c7f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d36d0ffbc2f4ca058d458ffd214ad8816173c50c79e95ec4972e30f66055077a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 da1fc46f2b73d783cc45f851e350ae63c7ebcfe0455bca4a85be681e14754160
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3781cabcda33f245e1ef243754f15851fe1a682ccc151893877b80acc5da222e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 c906640fefc6481dac6e9249198dfea7b906c4b64903cf767d88646429ad62cf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d34c9f3d56dd99e9650ab1d922bac24c921c0cb5d3d0dce852b79d6c452ccdfb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 34f54e4cb34560693a3f807f3abe4830d7c69116da9bebbd9038d1f049e5252a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d39477a83c02fd4576178adacacb926a7a5d60e1268f8e8e551d8c73945637db
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3d70d631b6a6bcd44d4d0cd0659823176c6a95b5961da689585c274073974aff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 82a2d686de8779a1d0baf05bfb427c5e86170dc94aa080bca26139d841724316
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 9dbfbe1f768aec0fb3550a6d6d6b111a1d2f271c422af13c550315ca59d3b1e4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1f663ce465e9c17a933b0aebac814a0141c61e632a7cf41deb2d7bcc938cec93
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 fe3fe7c5b6aa881772d2bbe79addb5904d7e268f56ef47b72e11a63987c75ab6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 c3ce9911c582364446e29bad386f7f046c53a634afc673c2498f73f093a26ba0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1829c4da94c1e63cdac00616d71f4b984ff085c64bf2cf14dd4003005b611ece
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\lasIAwwI\geoEkMog.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 879806cde245f4f37607c23f8c7c8690df14a5aae0127183836d2181d62085ec
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_f977f28289a8235524be25e08265a602_elex_virlock
                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AIMM.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AIMM.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 fcc857bb70c2b9d634d51dbefc2bc7ddabd100a7b67d0fd63d13267f94dbae72
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AMQI.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AMQI.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 23cf54436e2958ddb098b7aa7aa95cc296c9a16b356af8b6bf7642756366aa66
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AYIw.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AYIw.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c23259c6c6e3cd460440390339fce284c974e0df804e30a474f2067eb00aa9cd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AYQY.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AYQY.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 f406d895676c07de4d8afb5af636751443246a121bb8b3fdd2ea18fa44b8ec4e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AkIe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AkIe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 db09f097e7d5b42a6924388fdb3e154741d5e73700a0d757ced97ca0ebfb63cf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AsoC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AsoC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 30af151b27700ead67d5d7d6506ff249c09907562fe431c30c049853fce59f6c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  AwcE.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\AwcE.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 fbb5a0e9ac39116abeb37464b712a11c31b844079f340a324038ece7bcc7cffd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CEwk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CEwk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 16bdbe5d974c796f6e046f9f515f3eeee1ace562eb365019d2c33bd7323cf160
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CIQG.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CIQG.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a3f70d31a201a46bf0e9c0019daff11119170ac913b3a74165eb30e01fac8742
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CIgU.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CIgU.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5718b8070f1995b6e697ee00e4db85f4f6b44ce3dd32ee3664adee527c6092df
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CMQK.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CMQK.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b49dcf8512550ef3fba93a1bfd96b4399bbb8c4339fbb22aba9726fdf8f123dc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CQEC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CQEC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 deeaca3de40e2c993864676be85464269d03148703f2ef2051a3662f8d5b1fe5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CQEq.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CQEq.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bc55441f441da3a4a5be9ab4bc79a9e5bf170d850adeb8df8f12caea44f2e78e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CUcU.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CUcU.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6c8687378df1c734bee21c5809625bdbc48ddca67aa38099a8cb720e0cb4dd0d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CUgM.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CUgM.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e01229bde167e8554ffe86264fee59a0de52f340202c4b4cff10fa85ec4e15c1
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CosU.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CosU.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8cb03f62473aaf9b515c24e69306cc20e66af5c18090bbf856dfef6a736580ff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CsAk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\CsAk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 174546287fb46634bb1ab5e30b85261e8806928893e2f084b058e7f753708fd7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EEAY.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EEAY.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 edfdfe0983be7b94cd28575363871a0573bcb32dceccf4e404294e6a81b85704
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EIgQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EIgQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 37accb9a253a384e05777fb3497cfb3b732ea657503f036265f864cd2ef9a5a3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EQQQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EQQQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 adb7d563893c634aac4d5c2a6a1305df391a1ccf4db9985723cd9959e93e2627
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EUUy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EUUy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 818f1e9c1b453d16c9a4c4472de8c7bd544ae28500c494565982d605cf62a0fa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EcgG.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EcgG.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d5a963dfc77d0c503074fa675e78975bbb1dbcd351b378c1ce0a77346ef4a4ae
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  EoQy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EoQy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 739e3e0076d8a3dc78503d3e123bc75925cdaff5d8f0f4a95ad63385ef50fee4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  GIog.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GIog.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ad9fe858b51bd3c5d971c75c0cc3b0837699d9ca12c8a749d789db5a515572bd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  GMgO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GMgO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8e0a2f51496645097d2469908e5d9ed32fd3cfed109e2e0faaf40d116324c838
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  GUYu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GUYu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 2f8c14830048d5577547d557689d2ef87965ddb2d53baf05ddb15ab5c8506285
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  GoAi.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GoAi.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7a23a0da69af5dea053446db1ffdaa3eb803df8e184b4bf1abe36035a7f4cb82
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  GsEK.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GsEK.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5f9e0f9ca016d7e201dc9f08d609fbccf455296848298405a02078fd9d6bec02
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IIok.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IIok.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ea1d158d011620eea8e2de2d05c61f29da65eb916f92110ef5723f0cbeb1e42a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IMQu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IMQu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1e31ef9ba73c8c0223b4e32e95ece415fa0b7ae998b518d5394de2e6b1ed8341
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ISAIgoQM.bat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ISAIgoQM.bat
                                                                                                                                                                                                                                                                                                                                  • Size 112B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IYgo.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IYgo.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4f0f62bfd79d2828436ce2b38feed573fafd733e35a7dc620d1d98af704eae27
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IYku.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IYku.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6ea1d9872ad29dbd808d6cec3b548400997165e7824903a037be3e429773c19c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IcUG.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IcUG.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 f14aabd2d0aeaa4be2be216c7d43a1453a85352e717098890ed397fa1035698c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IkAq.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IkAq.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 303d040ad6859604226fff94189b3242ca54d3ff6bca1f1ab8796644284dc5ac
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  IkMy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IkMy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 157c05a6f194f1c881c18e8d7ebabe2ebd610c7445eb6eb7bb5c830e87161163
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Ikwq.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Ikwq.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 77cf073d1b0a2c941fd0b5cb0547382a8bd41a9e8527a1fce8d2d9569edb2480
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  KYMy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\KYMy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 70a47f1159f0e0d8a4f29ebef5a98071e63317cec6d052103fc44c58468a5377
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  KwsM.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\KwsM.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5bd6d89686ad1058e43553eb1148f96153d1d76ba66beb40d3837df5ba0b65ca
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MEsS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MEsS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0f54f4cf57f7da0630093e5e10a9052cd91db0c74212fff676a09e5cd95b8191
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MIsm.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MIsm.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 62efaa0e8e28d707ec6f51f4cfa666e246e59008e30d50925398daeda89bc5b9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MKwo.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MKwo.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Mgok.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Mgok.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MkAe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MkAe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 28ad0aec253465e0d9ab5a3e9c15a6d427f2c2a2c21f22fac4da65d6689aff95
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OIwe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OIwe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 380a226bb9b0eef43b0c402ccf6a1537f0de0e194ced171649a79f4ca65fd530
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OMce.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OMce.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 51b551fc806600ae055168f3b9bebb1fe4ff7f1e4528893f1ef8ee652bcf8345
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OMsO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OMsO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d60c9f133c0000b82090395f72e7b5945cc214e3d90ac05430b85fa9693b88a6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OQwS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OQwS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 224a2d13dd2e5da8291be40627ea8c5fb80888eb38edff03cb811ab867217394
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OSws.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OSws.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  OkYc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OkYc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d7d6836d8542dd3f0c9c1f08f544b404a93fc1edd52b84e15f6188bb53f42744
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  QAQc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\QAQc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 61c1fed445c1a495b9fbda63e77c991aa37bd503b797fba035c33fc2a3c4b134
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  QEgc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\QEgc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 57681348457cf56cc3e8e5cd495f8dfbe88220d7e713507de89b30d48d9b1652
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  QMUc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\QMUc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 dff2b9f4a041e74487f1428a5b3cdb377144a6e6add602fb0d4381a1b0a71f3b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  QQIQ.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\QQIQ.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9c9fd45790fe956176aeab743484780b62f28a6dcde6e85cb6c6279ff3323b16
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  QcEQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\QcEQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8c900540d4c3ac75a4f454c9f1bab71b56298da2d8fd8f57ae83b7f567b60906
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  SQAm.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\SQAm.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bbd794be53e20772874697678754c678d96cd5ed9cb452084c8842f3067c0bc4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  SQsS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\SQsS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a7d4732348b2b068191e8405f6a86e51026441901b92fa22811403d76b6479d9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  SYEg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\SYEg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8e30250e32287baee515e1cd63b6d9f0f403da7745ea915842f0d69d60b143ab
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ScQg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ScQg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 71f7c0accad186f77a9e244af9193ea2229e005de6d7e4faedc7f7edb01fcdeb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UMAK.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UMAK.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 66e925d253b049d122b0f18f2ad9d0b49e9f024de7a3440e50eede2b6e15acb0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UQgq.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UQgq.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5ef4181815ccba14f7e790a44b6de38b7bcaa7fdb0c182c6fc9255ceb5e0573d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UUAe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UUAe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b80a07d8cf8f900c8ee84b421e779c98abfea9f11d4536b5e03c5a503ddbf5db
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UYkC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UYkC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3433c3cb3308ab6766a7e714aa358bed1b68e9c91985743fba747176a7b3753e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UcYi.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UcYi.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8df56b0c3d88d5b32b5690c834b2ad5600a57d7cb237d1a725bc0249de1e7afa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UccO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UccO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 dfb404188fa6016d1456522b1449eabdfa8c5c80fcd79dbc5af188d38ec05d77
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UoAC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UoAC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e08440c1a3b3d074e30ff423b3aa3cff1be61ec6c499b26be5c2b3ca27ada75e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  UoAE.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UoAE.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 79020da4c97834ffd2f6fc2519354adbffd5c254af54153b52acb7f0591b41fd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  WkUO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\WkUO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b9b0f8ba42c672c5d24597a85004ad7a7af4a826a7bb2dac04d31232140897f1
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  WswI.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\WswI.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 088a898cf0ca6051f20cbf198484905b9df45ff3fa36a95c41cf3af695743d32
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  YEQc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\YEQc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8a341ccc143aae8052b8587c0bc6270906aaf440f6139831ab70ddb4b6f8ad47
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  YMoY.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\YMoY.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  YWsU.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\YWsU.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Ywsm.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Ywsm.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6f2e0165e2b78cc97f733f34865f216e591324d0f6a89511191c89f8bb018b2d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aAou.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aAou.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1ee6a25905a1b2eeb39c08b38c2f4883bb7068697c07c0adcce1e62bb0458ad7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aMoc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aMoc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 93ec78a7396124c553e92f74d05961c6c18374fd8e77ff618d248d3785bd0fd8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aQIc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aQIc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 522c9d49cab8417603ff4b0c8b7b067e6d40540d1251ffa140343d6fef8469b4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aQUO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aQUO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4782998a1a2b5eb6fc0fd0bfe89edfc62bb0c5611c0336232a00f87efb1c7d46
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  agYe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\agYe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 691b526b63a510a6761e046f7b32a4925238e1f8da3d8f574df51e3c7b9fa74b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aosU.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aosU.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  askI.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\askI.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 de136400f0a2424e035de2bb106809e7b72f95b02151697980678859eec1dadf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  cAIW.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\cAIW.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6fbeba4c04be78ce90e5b19a0c340503dafa482eace6c489088674a7bbf6c473
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  cYgE.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\cYgE.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 58fa4acd55d19906cec2b63bafb6bf9e5cfc78aefe687c7816e86e504fdbe0c6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  coEy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\coEy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5c7f7898453f749ea3dbc008bed957e6db4982952a5194c1691afd1eef0895b0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  coIQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\coIQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 23c3fb5a76442c46dccd8581bddafc316fc2db9e36509293fd5a7c42175a4b8f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  coUQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\coUQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7c10155dc5f259a2665c3274ffa7ca64ec620855cc5e00cda1108157b132f12f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  eEQk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\eEQk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 58ec9b5055c5d688f2785c7aff6a7c4e2ba3d773d070114b74c3712f9726316f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  eIwe.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\eIwe.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d1c1c2cebccaa8ad4f318caf25e48a334baae29381b478d2a833695d673895ec
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ecAM.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ecAM.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 58641c244f18aadf19d8fa97de15ad210d11040d786be66542deca2678864b01
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  eogg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\eogg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 949fa1dfe7363fc208cab9e2942a9d630b1acffc336efb4e29a37da159d50774
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  esYO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\esYO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 944617021d8b5fb2d001f44d518551ff1ca268d16cefe564d629607832032047
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  file.vbs
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                  • Size 19B
                                                                                                                                                                                                                                                                                                                                  • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gAcg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gAcg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 7.3MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 59d933f36bde5c9af5d0cbdc14f87805aa51e44f2741a0258e2fe0272e281c6a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gEIE.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gEIE.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 dbbf9aa1c479acd3272e79772e379df8e9d1194df14ad7501e87efbd3d3eaa94
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gIos.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gIos.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 07cfca55c1b5a0c2b4e68c5b391b45f53e5ef5c4da17ef7c8b21f215956c442d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gQIM.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gQIM.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4a0257934f277129d69a9807b44280f101d60fc8e8afea9d11038612e8e1bdeb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gUoc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gUoc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 16fdb52d5b5b7743607cccb415da26aa281a59f7dee6244b7139c97cc1fd93d9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gcMO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gcMO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5bed600e7d5fe050a60e9dafbb220ee702ad65ac9ee93d5f09a4b319a0fff8ff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gcUG.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gcUG.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1821d80e72d158f1ca32833511e78c439639b15545872526da47e5fb386f4c46
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  gswi.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\gswi.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ba5fa79f5a8b2003f64508a25326f1ccd490252ef97ca00442af87bfbe807d56
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  iAQI.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iAQI.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d6f5b0d638b7fc6d7a8566adcebea7d0e8576b723f87ae9882650cc5be8e9ff9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  iIAE.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iIAE.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 365fffa26a461b3259ac875fff9c93851b54f5130f160139c8b72d4c4f5ac891
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  iMQC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iMQC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 abd590d6b0a4dfa3c9796bf1a97691ce49c37640059524b4f9692ff6b3fd3607
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  iQss.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iQss.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c7159f4f0341783fdc62c03c3ea8dc62c39e6f5f77bb7619ada3830c6d2803a2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  igEC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\igEC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d61d435869d8ac346cf5fb776bfa717fe391b86927e70fa1af65217e9b2b3a24
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kEIa.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kEIa.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6d961050c689deb3abecdffe928975e53c0e5fdb601a4801eb6c45695b111163
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kEUi.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kEUi.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 21b52c438147f3a68644879a6a788e2522f5c5067c443b0e6b6076c8872feb3b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kEok.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kEok.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6ebe3084f3cfc29595e2e6fc8bf84b3fd532867407707f988bd08953cc0b8b89
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kUYO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kUYO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 faad420710a2a95cafd8232e6a34f8e7f97b590edcab9ddf3e7112d82007acd0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kYou.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kYou.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5215b0c5373adcb1637c54ed638da2d1b9403ccf461aee24b90a4d6cea878009
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kcEW.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kcEW.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 53227be679c783a2955043e74cf517f4ba663c7dc542a7cb06d3739c66099839
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kgQu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kgQu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a57350f699752dbeada0f3d6fb56d64a1de4130f936cbc1ad38c45f81f045d78
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  kkYo.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kkYo.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 104f1c20dad1546f3f78b7ef01f1ec81cb03b9fcfffb5e4e816b6edb775a708b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ksAS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ksAS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c062bf7c6ed87062d1302fb780fcaa9c444dc53b1494fc73b765dbb392791d34
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mAcA.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mAcA.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0a49b7aee89de75f50eb696f790197351486908453d5fa56a798721dedac6c1c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mUUw.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mUUw.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 13c176ac109844d094a11640c6e27270f2eb9b8bb0a3b6f83c36538f5d94da11
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mUks.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mUks.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4e1a8de85937c3938506776b074203b9f5f3f727a006bf2e2714240c2d9f7b6b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mYMy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mYMy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a0b574907743e0fe746f00ff34ea2287b56e16d1672d73d1f93eb28ea111a929
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mYUS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mYUS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 31d7f80b177cdb043cb7be20cb73f13739b1b9934819ea400afd1f2641c9fee2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mcAo.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mcAo.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0d9943cbd57a1dbc3b0663119cc37cb04e6a446520083442eb0004b5699f9e45
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mcMO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mcMO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 f2791721fa5be802669a1f3e86475df87b8c9d943292abeabcbe547fc3e5b106
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  mgQO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\mgQO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 2d1154e43829441a78742d99200f5aebac084410747a6620c30eb2c10993704f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  oEYu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\oEYu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9f00c5912cdcb62ca066afd5d694e564a3ebd958863c9497dfc7ddf0b3cd7f10
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  oEwy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\oEwy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 df1341df339a45fffba9036842eda619517a054fa48dfffb7f8bad5748699018
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  oSQo.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\oSQo.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ogMg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ogMg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7f0352a7b766c4c4ad242ade6bd0a3fbb285a0d994190d309b539f0571c2ba4c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  okYU.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\okYU.exe
                                                                                                                                                                                                                                                                                                                                  • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bcbaf264c01656e087f63dfcf2768c7553a267e73b6d7f746afff6f46f763ad3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  qMII.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qMII.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  qUgw.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qUgw.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  qYIs.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qYIs.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 12bbf0c503fbcaaa14e8f39a9cf1c95739300f5369c222e1876cadc07621c290
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  qcQq.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qcQq.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3c780f90b95433d2e8a6278205db622a8e0e22bdcf9b003f5dc4c415b168f5e4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  qoMI.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qoMI.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sAEc.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sAEc.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a3c3e8972e9f075a5de1d3ae2cb2874f17b6f1c0f6d90deb6840679fe983e4bb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sEcO.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sEcO.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c0bad5ea4b71173dbec76b27dbdaefbd4cc6ef0837061c40d9c39bdc65371789
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sQAU.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sQAU.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 773aba840d2907a66be81515caaca30431f71bf2b2c6a99bdf0b4043d7254fce
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sQMy.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sQMy.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c8fcefc16986635faa9cf4d2f5016fa35d408ccd233d65df2e93c54813a9d75b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sgAC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\sgAC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 640428e29bac9c7f287b143c69c174c22a9416045ffd2201c31820037439fd76
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  skIk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\skIk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5c86a8c5fe551d3ffe1c742ea337977cd4278666a920e4f88be2ca1b0c7d9029
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  swEk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\swEk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a14c598509c70b113bd47383bb4edc0ef91079380ac264e5c432afe867e6cad5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  swcA.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\swcA.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1cc8659efaeafc35304edf45947fd4ca1af5737ed7293f77faf37737c0c793f9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  uQQg.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uQQg.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 585c742bdc4c0611d3c590a844de295e0c3c532949c4939902ae4553f89db663
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  uYUC.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uYUC.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 cdfe1af9b717c625d95a2063c2d73a56ca908217f127e8977e884ef4d7149d68
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  uoAu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uoAu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0e4273fd30934ca1a0ac5b04ce05f750e27c21723eaffed85f7fcef04282c74c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  uoci.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uoci.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 c2594640ac347d7010e899de1be74e4519d2136f1b41854e858b2bd464c6c9ff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  uqgs.ico
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uqgs.ico
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wEsS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wEsS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1722e3306134fd71ae8ab5ee9e33600f079793410e570854d97d9339e125b5d5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wQQW.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wQQW.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a9f73f52f77de8149baf8a1104f815df4761ffa4fd77e968d76a090dc572c102
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wUYQ.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wUYQ.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e60e93ed157322f10cfad0de624a2cff6279a10cdb2fc063666f174d5a4aef12
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wcAG.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wcAG.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7dcd3a0b931b20d626ec18ae75eb3ed948abf2e23ea3ca5dd52c67a2cdfd4e06
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wccw.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wccw.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7c73862a3bc5e2b5304af7b6584b6bb58c96e01fc6c7af142115b01bb619d57b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  wcwu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wcwu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b39bf4249fa732d20f03e67cd7228b70f156f814898457bb311183d169a9b131
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  woAa.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\woAa.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a5885af89ffd546d1c35bac818de2d2778cbfb2d6b2c6b204a36c1fccd4baa4e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  woYS.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\woYS.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bc32cd075f4f1a6f4d2e4973855d49c56a79c94e5e810f339ebb17154ca3512b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  yQwm.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\yQwm.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 61c225e72766a61cde9b333f9f7d47a18b3e7c3eb78be869afd017fa10a57285
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  yYgu.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\yYgu.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 696b1e478ad289615da47ef4a08795a4e0e1c479a85d33606ac3a938bfa4d97e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ygEW.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ygEW.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9e999d7bcd1b9c4f63e785bb31206f668dedd8225f3b7b4a27a13123237e3419
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ysce.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ysce.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 97b732eab67217d6899b5d6eaaf57f2133e4f9abf2e53c2e49b438c9283e4f9f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ywsk.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ywsk.exe
                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b9806671b67201cfaeb33ed257893ad663e3060fd4656f1dfcc700a81981868d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.exe
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.exe
                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3a46dc16904cb67717580798f2786f60ee8cfcfff5629a0dbaddaecf4c1a2b95
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3c701c8560ff7637cd59ef8672e2cc7491e5d8db4c6ba545d38025cff5f18c2c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 61ab29cb69c9e782f009395e78616a467c1994a8e22e0f9e2f8bff1142b39d45
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4e05b3ea4f3d0d3e7560bbec91c6455d446761db1761d77d0d0e471d869d12d9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 0c4e925a7863cd28e0d993adf4850b8246e78e2e3bf2a30015eed9558228c63d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6d82162693ad7ea7f764bfa8ee08f464e67bf309735eb9bdfbffc960dc2d30ca
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a99fb754255699d4920898ff99e36105eeb9397b6c9738555787a2f964ed1c8d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a43b017abc7e8f9c886eefb68c26e54773faf2a43f52afed0ba57adb3a3dd983
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e4ee7ba91bca9054200e42e2c091d4bac29147afc56ccf60d2ef8ce19c4463b8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ede4f4992738d620a6d96620d6fbb5305a4b18c0d2d0c6dce3bfcf78df6d86b5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a50638a1deb450fe42738a5c13b54c4a985ab1e8996fe38cf6e4ed20a89217d8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b752e4a96d05dc0545c5ff79b342a56076810f647eae5aff974e8567f41fe2c5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b740b6206bc8b4ed66f0631ee67a40320e5818b97bcfb8a4f0c0757409ba77ae
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 8374b3a24025847de7665be84d321ca6673048fc916777c49dd641c853b6f81b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 11ae9b34a5c1fd9cfed41aee5ba413e0ed5e75188cb1f1a5b37bc9f7ad1531d0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 20357865b996f16ec0e729f9593bd2fd18dea1eb0898c863cfcc2c1808a11456
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 07cc41cb60928df8524c7e8226f0ee160702f7ba8cc7c8b9b532310cd9548397
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3de575e326bb27cfb4933b3aa580596f1db9fbc35761dc898589c3d5ff7d56b9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 82e56a421fe3a7c1e94af5b265877d2cc0eac429a09270779f8afdaf99c22daf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 08c504027fd2f9331456ec28694cada7c4cc357c34594dad6ced5d4fcaa44110
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 14c12c47eda6c9f83e7e116a7f006595fbbd2c8a82077d5722d89901e9d76a1e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 f7464659f45e4b814c98c8d24656f26d6c3523da94940160e8616c11b3cd9f2d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 c8c10c95e60bb1da9e6ffdfe97a7d54349464cb9b34ceb677d82556cdf7617a9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 be5edd9f6d2e69fc66a633294f5f3150f140be07cbf957aa12aaf60fef809289
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 cffc3de1f28d7fe9306daba2912fac2a6668f356c03da26642512f1dcc36a970
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6984646e12d1c09c3b1ac7b923d42b3c2e17cf683f4aa7fc36f756c56b8373aa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 468293e36d2b402eb749b7968b8875506e9063a3bb27a9b8fe001bee605c3a87
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1248d619aaf26d914d5b4c4c31d3c0a20d85d8104dfe987391a125c2c705af39
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 c860da9f6e62dd1af05654efa61ed99fb6f58f884b1e32a7934af1dd33a61d31
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 bcd6229768a0ab913ecdf145b7ceeb470b7d4cb94483757cfdc858554ebe9958
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 7c59ec0ebb1ac789e269914ba7da722c60fa92121d9303ef75c8273347a1a835
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e263764c5757b4e87ccbe3647b459e27b57bd39745871d0e83b5d28e4fa762a4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 96a160dce6280a617a71506e679335706c8e8a443350a81748d5569f4407b7ea
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5b4a8057d0144379d047cc083c6914581a0e0e5342cb3537549be40f794755dc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 52dd146b7ad2edfc1ac16a55f892a22b176962c3d43d22f818b3467312660a83
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 238147e9f5da09b72a755d2018ce58593148f88148fac72488d25bba1c794d32
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 9cba5a3de571ccebab03165fb6f7e71bc52b14fba3dd39c29b11606a6793bb75
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 471024534ef46e092bcf2e377d48d89e4d08212117eb98fbba8779307f181f5b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 f9b50fbe4797639d11e87b1498ccd51c732aa3565affed7b0169bb6cac79c4e3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 f818df7095c754b5fe463dd5c02571f451d0cddbb54e48c6623a899968df3979
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 68fe25a3df3dcdf76cd367e1b0b7196c01210ea7e7e0a4f89d5d2d856fd10dda
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 0ca2dc3ff0d21f8af1130ab93c3a6307bb0939d2cd3455f6bf5a68e4391ce9a2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 931a9b03109149bcde7d2fc6b194b0c83538bf67e8e73159d278ea45626e04ff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6486413781d649326fb463b8ca52929e3167ccbe4c6e4dfbd4fcce9ed09fe76b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 2b22ee224120ad34d1766f4894e735741f0bccfc4b3953bd86909bf652ab8b54
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ffcd367aeffe487f4edc5defe8217df14681070453fbfee2cb81368c12cacbf2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a6415cd30ca97b12f0975aaa63f75c8a0c4c4f8ed40cffbbd3ca6027c9b159cc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 8757a200fc36c721172b00ec15e542a05d8fd6f9a1b0f846d9a1f38b7a117165
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b0f92370639329b5b81dd3da8f106db50cf906b660130e05137ff5d7ec40d306
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1c07b10cfa5adf84b19fd46cc0dfb94779afbd8d0c0825dba338459e8ad53c40
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 78394c3701ab44ea93f0eb21fa8c621bcee5d16449f60351f7998f4a526e033a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1fef265adeb88bdb50eb304342e2690b85211cd063177836fcb8d0730f325687
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 c9d92759b80a3a0afe1866ff25cbbaa37c43e05922b97bde1451142fc1319a24
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3eccde2385a2aa2a6088afe8546cd8a85431bec391dffa5b1df5ca040b37cba9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b97043ef98c5425b183fdc7cfa326fadf5f80a6e33ab6a4d57b7becaac849d4e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 416d88557b727913d2404b7a8ea9cd92facb80870ece13a5edf68df48883ba11
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e46b94120444b9abf06c38f6cfd5bdc42949f3167cf17b38ed2ef6babe12ffda
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 14d66a181285bf40fa8042e2b58162aa311d5acc69d442d0373bfc0b15017f2a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 400be4681d08e13ad97546f43b5a63e9be890a5b1b935ea3d1d5a5b91151ff0f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 83d407dcad00768b026c2aaa1a12e8bf9999b2a2b299f96d8ec0068dd6ea7385
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 7f787adcc287c7885c84a7cb81e5e5064aa09837af08fecc26883a9c48cfdeaf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4c62fdb61eb4a595b61ae175e3af7a1ce865f68df7f826b4cee12e46c3a89094
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 de549eee32ee8e8555a0efd374b4f7eb46c908452e0685dc78250eee5d97d6d8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a50c2f67efd0a6dad5ec3b4bf9d892f344645abd6f41a166febfe0222b0bc6ec
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5f844cbc84a361bd1def562e7976a8e86534b54d6d3eed825f6ae8d14eaae979
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b02c70af8a881a7d896892ce71ea39cb6026402db15e25b1309becfaa2f60ed6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a5a5a1b08fc2a6a88fe30abfa6f55f7c2ecc55ac5fa0b211bee1c4407deadffb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1e41e67249fa95411930d41ef717daf25389cc3ba0b3efa6c4f51921b1fa4df2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d7d4b8c058edb4ed544d78304be3ddd8505eb72e5c25e6b79668f61df38db163
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b50540be7d844bac870847520f8306ab3df3148f2013bdd2dfbaa0108f0e5b72
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 be6911a093cd006b6b64fda36e2cd7d80dac5b38f4115b14bfe68ef21e8df1e7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6d1a2734585b7b07e05c1108d5fd867cbe2bdedad3e75df9f15091f3f7b0e81d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ba1a85912dce387bfe14948f75718f7d42d3220647c2cad6d2150f6dbb79cd89
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e472c009d180fa9b38b4c149238513e4c8d032e3d2999da834d60079b8dbb0c6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b8a5aff87c2ac2f127b77e42d2efa1395fbc3485c1e57f58906bd10e08be5fdd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e0411ba1c2ce9cfe4fbd8652095fa3d01de0238bde3b835c1e16e3ef61e986dc
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 755fd275a0be52b22062f8e9f7f5ef8f97124999ed5d67724344c592515ae630
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e6d1ad7994640dccf6c0d7000129318547b1dfb7fcd878cf280049a76b8fbce2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 21c650d900d8e19c9b8b595eadc1e23a4d9d47680d00b36373a75ea4bc175359
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 fb103c671d5c05df5d545b897f30a704acbb333dac68a310bad5b068a10d3016
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b61558c0413bb4981acefb4ad9941ab23d5b97983bdb5f8f0ccda6d331d98b59
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 0d3d618cd8ce7f6fc05951a22df27632ef610f37320d19badb1ded6abc1a4813
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 66f7c4c199534cde2d971f9ac4eeb10df27619ccf3d4eae37958a99c576bd9f3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 8e93e61e38cc17aa0b36339d0edf66edcbf67731afbefef0a4d9d9d350a6ba18
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 62436e0ad6cd43f20ed12232ceae1afb15aa32772ea687280101492d866e8b78
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 52fd7661679b5c616f089ee1a28f154251b82066fa1da5dc2be79b32b3530fdd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ada34ae72d6a53680ac708412e5b9b669a83f570ebf3984462ecd591b02c38e6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 f66bc65a7ee9f465d3705ed90317d986736eed9d8f18ab55d4bc06da3fe8fc4a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 93a046cd8a55762105a386b8b4922c89462c25b5825000f1776be7d8f74e2f1a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 3fa49e4a112c17b3bff7364c3d8c394c951586a805ca2ae63472b3e8e8f46738
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 7b198167c34eec98bbfb215b4f23fc03548881a45b93cd375d415f56dea28e74
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\icAQkQos\RoYEssIY.inf
                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6f28c56c066cf40e4afeb878a611591eab7e8da134997a1cd1ca6a24cafc0e95
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  memory/460-2182-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/460-2175-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1260-487-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1260-544-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1312-39-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1456-50-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1456-59-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1756-170-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1756-158-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1816-2097-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1816-2086-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1820-76-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1820-56-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1960-204-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1960-219-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2068-500-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2068-418-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2072-2211-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2072-2219-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2096-143-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2096-157-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2168-3-0x00000000008E0000-0x0000000000900000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2168-26-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2168-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2168-27-0x00000000008E0000-0x0000000000900000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2692-325-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2692-378-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2896-2158-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2896-2169-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2932-2132-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3220-227-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3220-244-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3356-692-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3356-632-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3360-2076-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3360-2064-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3384-86-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3384-78-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3436-2198-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3436-2190-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3572-83-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3572-98-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3740-2084-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3740-2075-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3752-769-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3752-835-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3816-2210-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3816-2203-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3876-932-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3876-986-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3896-677-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3896-735-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3972-243-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3972-298-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4044-189-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4044-199-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4336-12-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4684-882-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4684-811-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4688-11-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4724-184-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4852-146-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4852-128-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4900-2141-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4900-2129-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5016-99-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5016-116-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5036-18-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5072-127-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5072-113-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5076-28-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5076-40-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5232-2047-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5232-1171-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5264-2124-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5264-2110-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5300-2054-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5300-2044-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5424-2138-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5424-2152-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5588-2218-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5588-2231-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5724-2189-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5724-2179-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5784-2074-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5900-2104-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5900-2094-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5904-2153-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5904-2161-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5924-2113-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5956-2067-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5956-2056-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/6108-2232-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/6108-2239-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/6120-2240-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/6120-2252-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download