Overview

overview

10

Static

static

3

2026-10-04...ck.exe

windows10-2004-x64

10

2026-10-04...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/10/2026, 12:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
  • Size 1.6MB
  • Sample261005-pdwp1sgf64
  • SHA256 fba71e393c28bfd9a394da63018a9be9bbfd685f7050cb765647ed859e5aa16b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 63 IoCs
    defense_evasiontrojan
  • Renames multiple (105) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 62 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5132
    • C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
      "C:\Users\Admin\SokwUgcg\JuQYkAoE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:4132
      • C:\ProgramData\TAEMQgoI\JukskEkg.exe
        "C:\ProgramData\TAEMQgoI\JukskEkg.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        PID:2352
    • C:\ProgramData\TAEMQgoI\JukskEkg.exe
      "C:\ProgramData\TAEMQgoI\JukskEkg.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      PID:6136
      • C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
        "C:\Users\Admin\SokwUgcg\JuQYkAoE.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        PID:2920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1604
              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1220
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1812
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5228
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1728
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1980
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4936
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4664
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5620
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2376
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:592
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2488
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4228
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2696
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4148
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2888
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4884
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1460
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                  24⤵
                                                    PID:4776
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      25⤵
                                                        PID:896
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4312
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                          26⤵
                                                            PID:2916
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2836
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                28⤵
                                                                • Executes a command shell one-liner
                                                                PID:5412
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                  29⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:556
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                    30⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:1264
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                      31⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:2280
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                        32⤵
                                                                          PID:4720
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                            33⤵
                                                                              PID:1988
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                34⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5384
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                  35⤵
                                                                                    PID:2400
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                      36⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:3776
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                        37⤵
                                                                                          PID:5612
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                            38⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5652
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                              39⤵
                                                                                                PID:4600
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                  40⤵
                                                                                                    PID:4856
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                      41⤵
                                                                                                        PID:1420
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                          42⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4416
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:4816
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                44⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:6140
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:4140
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                      46⤵
                                                                                                                        PID:3244
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                          47⤵
                                                                                                                            PID:4940
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                              48⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4392
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                49⤵
                                                                                                                                  PID:4668
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                    50⤵
                                                                                                                                      PID:5152
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        51⤵
                                                                                                                                          PID:5848
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                          51⤵
                                                                                                                                            PID:1536
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                              52⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2560
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                53⤵
                                                                                                                                                  PID:5148
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                    54⤵
                                                                                                                                                      PID:4808
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                        55⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5236
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                          56⤵
                                                                                                                                                            PID:5988
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              57⤵
                                                                                                                                                                PID:932
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                57⤵
                                                                                                                                                                  PID:1084
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                    58⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5496
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:1192
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                          60⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3600
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                            61⤵
                                                                                                                                                                              PID:4560
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                62⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4932
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                  63⤵
                                                                                                                                                                                    PID:2596
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                      64⤵
                                                                                                                                                                                        PID:4748
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                          65⤵
                                                                                                                                                                                            PID:52
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                              66⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:4620
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                67⤵
                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:1080
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1796
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3936
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:3132
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                      PID:1736
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:992
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                          PID:984
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                              PID:3292
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                          PID:5332
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:2236
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2924
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:200
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sSEYooEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aiEQggog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YawMQgsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ocIYwoks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViMYckAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xOsUkcEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nmMYwAkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGAEgQIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CmQQoQAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YkcQkssc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:568
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iaAcwkkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VYAEswoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMowsYMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HWQwwwAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cogQowEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YeIAUkco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eoMMksUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\juYwksIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FssIggEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4568
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:712
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQoQYsYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5664
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZsgAkQQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYcAcYsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3872
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2252
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SYEEssgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tIgAQgcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:1736
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:1784
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:5648
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYUIYAIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:5628
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:896
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BSgMEsUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:1976
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zWYoMMUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSsoQUAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4176
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1136
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UywUcwQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:992
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:2040
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:3952
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygEkgoQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:4576
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSwwQIkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RYYkQQUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\igggIMUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:3304
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:3840
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OaMIYMUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ykUEYcEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:5208
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:2596
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HSUcUgks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:260
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwIQAYIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmgwksUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:5800
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WssAMcQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                              PID:856
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CckUUsIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:248
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:2568
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3872
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCMMgYEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:5552
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZEAUAcow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:1528
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2720
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQoQkEQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5180
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:4752
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3200
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oakEAQEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3804
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqIEUAwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                          PID:256
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2944
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1620
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZIMkkYUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:5272
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAwwggcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:2248
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qcwwwUgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:2952
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:2720
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oUgcgQMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAAoQkgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1792
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:712
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZAAEkQEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                PID:5240
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                              PID:5808
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqUQwckw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:888
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NeAckMIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nekkUgMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:2252
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UAwIUEEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:5968
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:3812
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YMsAwsUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kOoEosgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1092
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XoIIkcYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fMgokQoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:4520
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zWgYUUMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                  PID:1100
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:2072
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSAwIkcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:4228
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wgQcIMsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:5344
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                PID:896
                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\eYUsAoIk\hKMAYEks.exe
                                                                                                                                                                                                                                                                                                                            C:\ProgramData\eYUsAoIk\hKMAYEks.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                            PID:5364
                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\TAEMQgoI\JukskEkg.exe
                                                                                                                                                                                                                                                                                                                            C:\ProgramData\TAEMQgoI\JukskEkg.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\SokwUgcg\JuQYkAoE.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                              PID:3532

                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                Visual Basic

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1059.005

                                                                                                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                Hide Artifacts

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1564

                                                                                                                                                                                                                                                                                                                                Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1564.001

                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                GAcM.txt
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\GAcM.txt
                                                                                                                                                                                                                                                                                                                                • Size 7KB
                                                                                                                                                                                                                                                                                                                                • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 979ab556bdf3e30e8447c807067dfd7634b0c4b2d2744fd52d1ef9a0b50208a6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 30547d278fea40973aa085275903393c07e30f29f98bf5a794685ac403b0f8d5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 6d1845cb24aa1df62d8bf900066b39516dcfe308089d34801ee24a21f8a4d9d6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 4cb4f51b11a97617ef60c17228db33a09ac42d87372ecba160bc5b9d87ffd368
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 94167e839d92539912994cecaee4308f5ab245b3b5b996ee476ae0d5f00fe9db
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 542bdf9f872deb0eee752cc5edc61b428fbf18284a855bab6a97e32ae6875da6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e36eaffba9b826e9080800ebf9d37707d4b3a16658fddac2b2d57f59d8f9bb97
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2088c0b709876c078dc8cde9cd273a868be6245567a83acf0dd47e69c1eb6799
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 994114ec7a720b85e8b96f40dd2febb548b411e17e306c36231d4a3dfb79dadc
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 af230d253133294fd1cecdb9b70b5161b83e433265065cb3e418a627c91e334d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3ad8745f71b789efd20814f0bbc4267f5b9ecb8db1d2821e1c2f6f74fbe23cbd
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2a4464ebe46144515d5fbcff254b4150e8568ece67619c0a48688f8e31de355e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 29fc213b604c1863200a3bf743985a7ca1c414b15c118eb17aa17e4cb6748123
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a6c632f1ccc83494f6ddc9299b3e0c6e18a703f1efda3f948d757f2f490f5f6f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b4a5c972eafd972f61e95c02d4b829e66fb2302ec35c1fce060dfd2aeb313426
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b7e07a5a277895d77635065dff6ed84810ada31b33ca876485c69588d58c012e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 c549b74849d0b7ce6e60abfd4b3657b888f6c22b6fac47a3e044ff00a74e50ba
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 8343edd06c4098cda33b128550a3e6f33ba355cb75d8b306f6e12bbf8fdff5b5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 22e5274de4213130fa756012729714681d66bfaa23eb720103bc2faf377a4f9b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 25e43e022ea4658c9e3da0475e30a9f5c32b91b63c3efde2846197e742ff1768
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 6374afe34e480896913b3ea5d04a125e4fdc76b02d05b8093e97b96d82853533
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 002ad9e28dc86260d0fc00aae498b0b29cdef345cf322b0e76e092c192a9456f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b6a74facd3c3c22cf48490291bfcbe24e3a4d063f38538288c088950de099183
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 7c9339bab80bc75a2285b22480dae752bf91b62e81968352633728a00d5da09b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 7437e13a87bb3b60c3bab283bec1c33343b690262e2353bce57474065d1a3948
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 ca5c330c72596adf97e00c186a6c56eb0fce4a6b32516d0c31e23aed9195dfba
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 f6162e5847c9178600830bd2a453346473643da51d30d7da81a7a54269dd3e89
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e77add3e698e7d5a3ad75cf44004dda28061abb622e38aac80bfc95f931107f1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 6cda9e53c0dd6290d8b44688870943f83950f9c8ba565558f906c4d0a7f2fc2f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 1e8cd3cc5a1027bcbfc5d7a8be2c15c1f790f08c1ae1f889fdc95f544360bcd8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 132207e1b9b16f35a6265b5a3583a70c82aa9aff4f2fd1853c90eaaaf48bec64
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 bdf5e18c1129885c6f9444d1807811f463194d9a83110ccf8d975e7d25021a55
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e709570e5b735e03fc860c035099c28ecf5055d70208e699fd9e9e5490fa4302
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 565a970b90d61507416193af83fb45dbd72545c6616d67baceae0f61416e89f8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 463202e987ccb893a1814ccd5d35f50df02ae4cf960fbadc8d0aaa2a4f9e798d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0b30b4c88176691079673e7c34498e13dd15ad0850b22d44e576e1586078a99f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2b609006bc3c19db216d3c641ca63002f93723253a8a0ffbb9e64067b8c2cffd
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e95e2131948068277e0cb8482dfd4bdea56fbb57b1cd37376b2e0f2e6c2a7699
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d01449150fa1453bc51c82d8d98792016012f2acd561988ffcda2f62ef1ed7db
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2f0b0a1b956378bf481456799386337f002812da3e4e09c690088d2aaac36390
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 929f1cb85d374a3a80f3e7fef43b2dc935808980bc782b83e3e12273e630f37d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 71418e86e2f43317766ae9dcf2dfb976612d4c929f4439b387ae78d51e4eaee8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 bfa280f17ec892a2bf8d167e0de2bc0e91ccecc938ac7944bdcb9ff112f2b82c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 5fb4b0aceee3fead79b5f664a5c2e1cb70594ece2fa5aef06c553911449e78cb
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2b2a90c59bb037f5b6519541a37d9623ece70dd3cad6fff5a77934881c268b47
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2e2cf5df0824c678900240b0c2a384e36d7e5195ce395511a0f3d85b11b462b5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 dc65375202d85e32a5868c1b1a94b81dfcd0df5927d2f5679dbc801293d51c18
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 da8c65edf59f519a9aa9daf7689569342b402a0e487b151865e529b3798cff36
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 811b783cf83a209774f9917e0e68f4484707e4e84e9a528b5160348f7851bb32
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 811ea257fa3c38ac1b9714e31cd75efc3b4829deffb48cf9695c1cde9372a423
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0ad0a0d337683150475e13727b015240ab06f3eb367e0af4917202f823b5d021
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 381ee13ade44d5ad5b198896e0d84e58d7ceb6b2edce555f1b7b02ebd1c147fd
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d93ccded2623887ac36316fc496cacde9418a0744439c455250e0a43fe3d30ba
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 ce534e821fe96e135dc3603c36553581822abfbcd1bb4031db5d115e0b75b581
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2573d39f8eff7398a409da45ccdd28830c89d266780925108f189de7b9a1e13e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 aa5b44e7680682d78843054c034620589cf6874bb47c49d58de6ce33760e17ce
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d4c9887c42716c7a6eecf153b488db70505c1b4127341dd0c9300a40b682f958
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0dbdbb5c8085f7ce2fc6813038c47d4ba30eb028ad3c052d9a2d17154c602cb3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a572b439f9b70bb8a0ae53c4dd4a54ecacaa369ddc4a3f70e310dea2bfc396c5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 01c59a62ba7a783e58906ff9117e7b82ace56d24b7a9bfe6ed4f963edc978306
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 06921e9927ef58b753c188e467fa9f6584190861c9ab5c7d9d6ade948db1e15b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 5d3548c6e845848c7387a19351c8be61d40a5f47a9ce475ed2385e95baf6a035
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 c2d982741a80161ebe35e1a6fc98d195a71dc5ae38e6fe1b3f54b272b9a5817f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 832d8a338c8c60e3300e5895f3dbbf115a5c43ebdbe195807057e841392ed30a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 056f8a9b95dd2edfff9d7c022e6c103d18df34bb2e93fcb4b6d186a6c3eb4e9d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b6d0deff51fd39e9a5f275f42770fe6bcd06b226704c6b1142e99cc9d9226930
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 70e1193af834056415570863301c462ec2178664bc250f1454c651bd18978865
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e91f762e0129fc22f67a4f6ea79cce061b9c05f601bd46885019ba7659cdc184
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 ebf75e9fbfc6c4a6a95814e4633e7557786533543c34de999f98fd4f4e24cb24
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2484c8a9aa63d13c79e44122ff6edd77cfbd873bfa2cb2f46cbbf26c491d7a85
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b3067144585861db4c84d8147465ff450b5bdcb451dbc4e9ee417e99d31295a1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 7bca87e0eb024b01f46e2cf30a4dacdac0b29a63a1749e630646c424a956d624
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 92810bb0458416d14d0199e7401502f3869a31f644505d3d6e70c7601744ef8b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 b4f60130d2e949d9e112eccee26a3c3019790cf85201d16e8ef3b1f0c1180f43
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 f0cfb0a9c1257af95463dc47395c46119bbbcaf15c4cea6854e3f58a30175835
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 f9c2076f425f624b0b26649dfc3116782987cc88cdb75782f688ddbc2d8480e4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 c5b57517d94373c57c2e175de8c12f18fa81aaebb4dc60f91cea0ea1bb596b27
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0921e87acf6ad51d8a5e4405633bd13126aa846dfd06dc5fce4c6be9f4d426fc
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 fc7ac544a31e28cb4f35542ca99f2ce7f233ff2e10a611f022d4ddd41e4d8f4a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e5b010d1fb9c2f7c46d9bd6c77e562ebe10d6c3813cfa80342b3b4e4b3818bda
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3ba8235600a1f811db93597cfd1900934b88f99eef692debe623ef5a5c095025
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 cac09871254c113992773789023d7d0ffa48387668d6164e64a17c45f392b899
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 8fbd694656e85b038554eb5d97a7a234783c1efc21aa9a7c4b53a5c06eaab580
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 88f1f01e6ff702aefecb3c20605c4e875a3ea8c4e1ba2a4722acbae352647856
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 4b68d424ceb381101fc5fb44e338af93a6cc9a9358e44dd6f921e793b7f265f9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\TAEMQgoI\JukskEkg.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 5f07ceee24824611cbb2b0504f77e8aafc53bc7db53f8be51cae9298b0b2024b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                hKMAYEks.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\eYUsAoIk\hKMAYEks.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 2615affe94cf444fdd110569ced3df505aab882d930bf7fe2b659dbf0684ef24
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-10-04_68dfea5c0d5bb635d4678b16536effb4_elex_virlock
                                                                                                                                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                                                                                                                                • SHA256 74809a096cfcdd50703b501f28fa3178d360add1daff158008af7b7daa588dbb
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                AEoO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AEoO.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 e9dfac94ba34505d6fa2381cde3830f562938186aa12f5d3231fdb3a019cf700
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                AQYK.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AQYK.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ccfe5f88e3528977417b0d9fd0bf80a35cf50ff610af9e34ae66753b0522e9c5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                AQYw.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AQYw.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                AYgy.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AYgy.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 5dbf8b0f190bd279bf55bf84b342c0ff510615952ac616be585c998b5db8d21b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                Agcm.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Agcm.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 38ad46341d60f128229db0294747c0f182ced4613dc02fa835026059786cabd2
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                AwUA.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AwUA.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                CAQO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\CAQO.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ac65198e853842488fd8a0be4224999d1dc4c8989f5867a4077f37177860e257
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                CUEC.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\CUEC.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 daecf6451b349419a953f738c7b6550bafaca4c5fb585664857096423fce75da
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                Cawc.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Cawc.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                CgEy.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\CgEy.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 f91145bd1d6fb0d7f00f6bc963ab90a1facc1708694b65737ca9969ab04592a3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                Cgwq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Cgwq.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 e3cf96111984f2ffa1231934fff3a8c02f49ca9623aa49e5259d819b2457e536
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                CocG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\CocG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 962fcf8ec8c9c9439485687de1dcf0f9b262c59d4f8991055bfccc7ba1489ec5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                CsIU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\CsIU.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 c0f9db014ac14450f39b09682d81aa1cfe42ccba0344548e7ce69da312f56ca9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EAcI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EAcI.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4b59c95b5faa97069b89422942276749c8477befcd38e270c6c024a994941323
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EAoe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EAoe.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 700d4a811a7d2be0148fc373b11559a2235a0d5be3ec2242e249d7e07ee33316
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EEEu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EEEu.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 cafe3dc969ee578b86d07635d5de6a95243b194ff8d384607fd5e822c3ac3c91
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EUkO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EUkO.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 a112c11825b9a955f4f6eb1c868cd98ad94170d6a01a81cb8c935cbda22c7851
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EckI.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EckI.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EmoM.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EmoM.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                EwEO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EwEO.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 a103d99c16f4f4c10453ff5def0b4c016e047d4e6fc778ecc2b7a09894933cf5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GAUK.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GAUK.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 97400233f533d9a7fc02cb692945071b0c1a9e482dc6e4688015609cdafb0235
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GQYU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GQYU.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 6da69d4a734aec634f3f4ebaa525615f08276bfcd0153e2cdae1afa5ee31e4c6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GYco.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GYco.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3e3b70ff08b30d739c6d167dce4993a8aabd0be785599a79507c0e1b0a411390
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GgQq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GgQq.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                • SHA256 245df7010152dd7e161892200b3681ccf099f22b8eb5127a7cbd10484ccaa90c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GocM.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GocM.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 a1618746648272a155d37084030ca92f3ee010c3ad18cac1edee096565e5d39b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GsIY.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GsIY.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 76e867cbf364033894639c4a0cce69195c9c675e2e41185239481986296c2cf3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                GscK.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GscK.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ea4738a0b329eee727bd55b04d6d58addfa3c294991e78b8cfa2073a57ce1da2
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                IEsA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IEsA.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 5fc0be63d5924acb40b600a9354d3f0fb7c911b0bcb4b4277efd65afbcde59b3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                IIgE.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IIgE.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 55a2fb1cfbdc9009dc9fc8243de498dc09ff2dcec98afd0f1657508f41793803
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                IgkG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IgkG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 d4a2b17b8a75a0abadc7a7c9b355a47a8e62b751c761f6af6c8ab2a05ff7e894
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                KAUK.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KAUK.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9b40065db728cb11d584920c2cc44967614dd868f16d6f3e627d46cb672efac0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                KIEG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KIEG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 8e39adf9a46cc35ae19a32da1706879693c11bffbb0da7315c63e97e92e689d0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                KMsw.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KMsw.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 6f3e92cf374521c7fd2a141e022113f4ad371d5c17b6e2fee5a95bcdfb8e3c33
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                KYIw.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KYIw.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 dc67249f0d1d16ba08431729d49f6ded4e2063f9f6f8b99d7da1814543437560
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                MIMc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MIMc.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 43940080fb5a023f08e2774a02c3196de753ff690b0e85d9948fde387e64bbd1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                MMce.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MMce.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4eb012371ff2ac8a9a9587bef112dfc2b4f05ae56fcc8306f6efe93c5992367f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                MsQu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MsQu.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 8b621ef9c540cbdc5074877f54a93e33b5f4003a446d1b8519d52793c5308add
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OEMG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OEMG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 5a5761b5d01fd6557b05841afac71fa622cf4de3f29487c16f511aa6aad3c870
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OIMI.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OIMI.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OUgA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OUgA.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 72427fb7f720106fa50d20ad09e93e960261b04ed766b29acec18bb09e86d332
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OkUe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OkUe.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 a2ab24b52a5963fe126cbac79c4660cca71ff4aa5907f3d6e9bd24388435ccf2
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OoAO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OoAO.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ed994863ebb4d7b4fc3cec0b867a2030a39d0fa4965d852fb575f257d627d24e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OsIo.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OsIo.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 270ec411ddbc886c3741658b5c34d43ea58b806920b4048c1465e6cde2021990
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                OwEU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OwEU.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ba1354b2cbaca4e65d604a8ba26e181c706c283ced691ddd84e4667f2347fae0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                QAAQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QAAQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 785cae44dea407c9e2cbaaf87e39ce1eb3c9c9bb12ade1d6377ec3202be976fe
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                QAco.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QAco.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                QQoG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QQoG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3c9e7464a305416cf8278c8b726529e48b6cda7ccfe4254d9c96db88b1b89014
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                QYYw.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QYYw.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 232345b33c8891d2803a452c1aad0f91c57ea53dcd681cbdd6d7afddfe25b401
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                Qkoc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Qkoc.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 814fc057e9ab83421bf573326d08316029cb772b72cdf2910164aed451486a7d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ScMo.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ScMo.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                SgYm.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SgYm.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4d7b819944441238b15de26084ed79983bb42793c1b34ede7c8cb93c24da8096
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                SsoO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SsoO.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 caf50b979f719d49a71ce293d435267e282cc1ba38be8026c3d0a9a1c64d3258
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                UMQQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UMQQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 1ed27264fe0e0a4bbea170190d0d4b9c0f168db580de55f07bce9206bab60b68
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                UYQA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UYQA.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9e204682aaf820f884739d23d3867c9e997effd0579187bf92b0b66b4334da29
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                UoQa.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UoQa.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 e0a0be2a3d0c355e800b2c9c6991ac8361884ad70ed8db418fd0bec3b636b0ab
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                UwEw.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UwEw.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 1568eda707ca57e6b6e2feaa53e02d0f7a7d9eda3bb92bf0b7180ccd6e87b3ff
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                WMIc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WMIc.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 73ba16a9d23929d41a2dc2e50e78613ad8c6224b1f504ba4a2a903a07682d587
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                WwoU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WwoU.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 c63302fb908ad2664699dab31db717ffea9f9174f70607271be2a20583d0145a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YIke.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YIke.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 32f4e0451bccbf356fb76c4baedc54c8252029d68af9c1c5d1fe49909add0ddf
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YMAQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YMAQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9008f5682cf4d5f274bd60ece72da45a05693cf6930ca1fe500447678a5c1a54
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YQgo.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YQgo.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 37e46c1cf23edab2ed96a258c401c003ff6c52a13b4836eb1c611de44112061c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YQwY.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YQwY.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ab139f5d853c4a1e4598130ec97d268e148c072d2df19b0b14149f2dbb991a49
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YgEc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YgEc.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 f5bd4fa9ec21945696a0d4eb4d7e487b239fc4240f5c97fc2bfb27801dbfbf6d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YgMA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YgMA.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 f34cf2b8c25902719fc4b9659972d747b51949413cea2a24a642d39de94230bb
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                YwQw.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YwQw.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                aYIu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aYIu.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3d8b36fb240875d58f642aff8b7a30eae88239bc85934e62d6c14278557d2b00
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                aYgg.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aYgg.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 b46e3c0f5811eca2f8d20da683d9abb9e55f165ffc7abcd424e2da9662d3ef12
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                aagU.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aagU.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                akAc.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\akAc.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                awYe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\awYe.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4783868616407a0eac62a272b28a51e25c272992a5ad8c26874556e12ce7cc03
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                cIww.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cIww.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 fcbaafc5c8fe36c246b550bb191737a71ebbceb65334441b9c7c457c11bd2b37
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ccgo.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ccgo.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 0e57f7bc6022b284a7fa3b53682327364f90c2ccf7d53ef81243a53a0f483b5a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ccoq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ccoq.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 c00d753a44ce123f54f4d91c7fd23f52b13f39a0144af5d5e0bf6091f8835efb
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                cgYI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cgYI.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 c48a337cefb04c7f500069b03d1ef8fb233c21bbda8b0f7b16629a06d0d82069
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                eEAY.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eEAY.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 d26cb5f59917cdf7d3a40ddaa394c3694472ce6475d2b4ad6ea8808b61309821
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                eUQy.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eUQy.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 e6e72325306ffbf9a8948389c3578baf02342c8529014c302e3e3b9f74724c8a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                eUgq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eUgq.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 6dfe138253fbe90829f820f2617d0fc9bc491032ef9ce35d789056c357266fea
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                eYgA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eYgA.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 f09b7337edbbe0aa18ad0fa11e9986157c4eefbc3b34a2d3de0612e0add4fa7f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                egoI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\egoI.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 92d999f0867a89895fbdc099ff00fb423ec1531009214c3e7c9b30bab510ad6a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ekcy.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ekcy.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 d16f890b11be09512b2d7e0cc5162aa0c8637585f1386b2ebeb41752e9cd2848
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                esoc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\esoc.exe
                                                                                                                                                                                                                                                                                                                                • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 5fe7481c14fd287d32635c6df4bdd724e9676291e9a2ff1584b06c7a2e29ce91
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ewsS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ewsS.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9f47d427fd617e4c874282675aa44d08d094f6c6b3e6304d851bcd803c892f33
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ewsq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ewsq.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 20de2dbf7ea7fec488a0eac6bc630d7725826a1f5d40c4acfdf63fd42bf200b1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                file.vbs
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                • Size 19B
                                                                                                                                                                                                                                                                                                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                gMIu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gMIu.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4e66bbee98ec5341983e34336f30a76476f145a240528c8501cf4ca872840c95
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                gUMe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gUMe.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 59597e389eab7e84e22c434018d01d8b3a6df0a204e3d025c56ff57b1499ad81
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                gcUW.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gcUW.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 169051a6993e925dc2ce14ee5ad92a13a47a507838323737b1eae72bd4312414
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                iIwe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\iIwe.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3496026506efb184294d1f837ed77ff0a5cf7e20837f65e0454c6004d70b5115
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                iMsG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\iMsG.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 22f3ef2db006576309ddba45b8a310b0a0bf5d850ad2c23e1d05ff160cea5ab2
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ikYA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ikYA.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                • SHA256 7f45de3353d8b7e1f49ed0b7aa9b2a13f1a337da9d9697848af736303c96c0b6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                isIK.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\isIK.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                • SHA256 39633ed16090c7c397833bf0186ae4c263371f1e64c50ffead4daaaac37698fa
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                iwAq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\iwAq.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 2299ce38ba50111dc7cb90ce638acda6f388b2305b57be514cdced83c4dba993
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kEEC.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kEEC.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 514c8560a67187e2b9e4018e805c545cfcc6036a9f8edbcf0e1ecbf87a8c3c22
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kEIS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kEIS.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 12fd9b57c3ff32019ad40baaae515a7b0571decce7cf8c9e9943618f2704c1d0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kMco.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kMco.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4addaad5e1dcecb112564d92a46549dcc75588d752f0bd60260420381f02d9d4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kUUY.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kUUY.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                • SHA256 7d41516e23541107891b27fc00ce33047b42b3e9ed151a63a961886e3650f92f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kaUs.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kaUs.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kcYu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kcYu.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ef6d4ccc70594bbb1fe32c3b07d9494548f93d66af2abaf9d4825c1b581d026e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                kwQi.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kwQi.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 d3149aa966df144bdaaf0460e1e70001124f13ea9718c6c57fe647cf72520db9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mEgI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mEgI.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9f51da04a20acb176d1684ab68050361a44259f7b8a0e8ad188dfd401b0de58a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mUAa.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mUAa.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                • SHA256 891086eacff7abaab9753a09e4c224bce271c114806ae8d11a51d4c9d6e5628e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mUEE.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mUEE.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 092e6484ea783cd45e36207635a1a5650bb76bf4cd2a77ae1a47fe9a2631f01f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mYUQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mYUQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 bddb4b8c724c7badb8ad0050538dfe8392ea5ee98b63a17546905ec08b384a06
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mkcS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mkcS.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 617ca6d1bea1e83644150f8da50d1c3e8f39fad274617495c82c29f0c5970ad4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                mmcw.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mmcw.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                msgS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\msgS.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 259690e7dbf48c3b956ef7a99afeef84bfbde9b60bf6bba9cda4e2be951d4f59
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                oQcw.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oQcw.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 eda6bd4767e7797cbfe2c9363d6219799ae5a7592a993e3409ce1d33bc4b772d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                oUMi.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oUMi.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 e62df4ad0af0c6b641cea6d1ef14f6aed8252daa368cbe77d45af4202aeef201
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                oUcO.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oUcO.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 0494444a8d08037eef4beb8d2bbe875775d6874563418a813d7503c3189f2e8f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                oYYs.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oYYs.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 b858a92e0365665d7c363262d04a99d4728783360d01f56b3068b115983095ec
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ogIU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ogIU.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3389be0138b2262e2d2c8c91174e7d04d3bfd2367955ee79bd3e060e00a4b16a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                osII.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\osII.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 52db5372b0cc37b2856196ce2e2763e23394be7e5433d71347d0fe7976eb229a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                owUE.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\owUE.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 063d31c50ce7141a25cecdba8783b6c2b0aaefdfa70eb2958f303a7763d7e5c4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qAco.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qAco.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                • SHA256 c16278426ab7c0110498d8dd2480100ce4c52ab39f5bb7c011b6f1204cbf1918
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qIAG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qIAG.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ccf55d0b95ca1bab40c6e4a6568f342b8f83243c10962aae25abf76964566dc6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qIcU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qIcU.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 6533f4649440d23e5d1e499040317431ad8f646e5462051f7b2fc0c88d724883
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qMwQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qMwQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 1f6609e656d345feb4771bcbee2bf3d7f92baa50e5333f7b2f06bddd846c7781
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qUUk.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qUUk.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 5bbb89a6cb2ae78af313561576277b4826e1c730498c53ec2589e1944d17798d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qUYG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qUYG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                • SHA256 7c00a9f375ca34fda54e3a083e60401373dfceeaad89db794835d49f135d4938
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qgQa.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qgQa.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 544dbc50810ded44e91715afdd563e9119554398ef853cb62de5db8ab8999f72
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                qwAu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qwAu.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 46da4ad124290ec2527aeb4d8ced4a052559d2eeec1c7e9bea48eea1a0b3955b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                sEEo.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\sEEo.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 f89a8bffe1b1a5f099e879ffa1bdbb203b757baa25e6ab8f5a04144c4b8eedf4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                sgoG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\sgoG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 7e43a7baa4c4e651eb2da969a0af2edd2d1f5480c84269ae0c8e7c7b39c89f64
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                skcg.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\skcg.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 fab09b694fcf7ce9e2c5cb78b85cf936dfa19c34fa6919f2c90c114263b22edd
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                skgq.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\skgq.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 2bae90c133d285b6fe777894dbbedfc0e31de4b71200a7937cd8f068dcc1dac4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ssIi.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ssIi.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                • SHA256 4830d8b58065bb02e5d37b380e811aca4a2a813246fa6dffd6509ed0989799ba
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                sskG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\sskG.exe
                                                                                                                                                                                                                                                                                                                                • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 b53e3bf38828cd1d90441c30876266553f5575068c1d3e905065ccc5e11a9ce1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                swkG.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\swkG.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 6ccde0953bf3801195ce565395ac879d7c81bbf5bc0f16aa62cd14deb088c6ca
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                uEcI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uEcI.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 ca46fd9ec1cca1ee57d6fdf37cc53932b267c7337f634010c4c91f9c1d979524
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wEUe.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wEUe.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 2d4206955b5062bece09654a0b9e89911260157b8928bc83ad414a024383bfe2
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wMMi.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wMMi.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                • SHA256 05d94ded5ccd77100263ece3bedbd2b3458c1287960a75cdef017082b22ffd82
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wMYu.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wMYu.exe
                                                                                                                                                                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                • SHA256 dbca95c1ccaa57b5359cbd5c4304834fa33c5970ed2295e5756a4be8aafd205d
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wQEE.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wQEE.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 1974ca1eeb2aa0c4bf577ebfb0aa0a7b60130ab11e5125e844fe2e6f267bc5f0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wUIS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wUIS.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 fcbc4c4103213272e3280c2863d8959354700d440f7f6ae5ed43c1da3bd35150
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wgQcIMsQ.bat
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wgQcIMsQ.bat
                                                                                                                                                                                                                                                                                                                                • Size 112B
                                                                                                                                                                                                                                                                                                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wgcc.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wgcc.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 3c8f723f2036aac8abed5cb18e80696ac876231dc3145b6e1599ed3de4d0fae1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wwkI.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wwkI.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 0cab4ba12423dfb6fd609407351a9bad0bab7a6096237cd03908568474caddd3
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                wwoa.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wwoa.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 d1fc00a9be0532d3295d6b2f80a071cfeaf26a0b68b71a88d782dbb3f016b037
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                yAAA.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yAAA.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 cc276d72278d88b84d6dca415a427bde4194f5f1ad2e0f5045859dc46445492b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                yAMQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yAMQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                • SHA256 72dbd69db66edd2cc1e33926d5e3c09092310d445e75c9d41af1cad6d513eb44
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                yQYU.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yQYU.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 910570fdd95b9c38e731a52235f4838a4872ea529cbc9ae5562818bfcaf427dc
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ykoQ.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ykoQ.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 758f1c34abe8dffbc3d655ebb4dcefec936e60507c65fa288549bb8f01957071
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                yoEo.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yoEo.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 df6534299d9c746d522d5c3735667e7a0d8dc927bf825f1eb68394b622a88961
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                yqcA.ico
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yqcA.ico
                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                ywMS.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ywMS.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                • SHA256 7e7ea4b7833e9bc389ce286b58d73c0e2cca89940d7d153473924cc9a701ed00
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.exe
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.exe
                                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                • SHA256 9551cf65a1376f46c4cd17d6eeac0b35aad7176e557160620b49b56e40cce441
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 1e51fe557e327b57b80579a70645c87a1be92bf68bf2bfbdfd6e5daa1f581141
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3ed4c0bdbd4b7d4dc88ae7ab14f38f6b8320badd5e7301a62c876f4c4fb6056c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d99a8e43e1e50ba5e7b6656a2102a03deef5a77147a45afe11d01aad78e825f9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 ad95cca28d9812b2d7a2e4b0091b6f46b0ea9bbb21a9db84c117eb1646751f57
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3d1f4781ced73a21ad81ed25a1349bb8bf0e0d29908431751c7a86ce0f9acd52
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 97c0e787a7dda7da5baf54f2652a80bdc914b6f4f01a63b48050cbc99c131a9a
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 631620755f747ee7b90ec95b11029dcef33892b7ac7ebb6cb9ff91d6216b4853
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 333e893dd56e437f9be83e6bc82d2b2062323057d2f58f19749dd90a5d06ba17
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 484ea3b021493576d9c23eaf1ecc84efc732ae729cfbbdd992ead4d715e5a319
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0b4c0e18bd1f4ad1a5320a33f9db43a85800e713c794ccc914fb893432d9d17b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 6925b86beb727cd0e9aff4c8f3b944de98e91f25bf5831715f71d4c43441b6db
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 9e2907ab72b405ab598eee6503fdac4299fea5db983a12f8f4248161f341fb09
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 95d0aeba6c5d9c04ded08d867445f3e87bf82129eabf74234a3aee190c14a9cd
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2598993a931cfb4653cb93504492ffd524f9a2e461a4d6a5fb34e2306943bd82
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3bd319b1d7ea16fe225f781771b7f436d22df59ce680223d1cff6c7221649f0c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 91517d246c1b2c831f93bda8265ec1434a4bd5f875bc264cc81c1f3e8bd41ee5
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 750117e12c93a5e56c8b3c9f650339435289224b28c64186085f42a1ee096980
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a904687c8c6e13dd4b3cd42357b670f659b48003a4e509d6aa2a00c441faf7ac
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3ebc4053a21cb18a433b8ee96533be1709f0f763ef83d09a05be9b6fda227983
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 5430e90f09f83b439a15fb8c103471307b13eed779d9ead9f7c361bbbba7106b
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d3bd9b5dbefd19e3b60e8219503a226e6183b9e03c9194ad0a271528bdedddc9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 96f7e6c23ce0ef1c9ccc9fcabb6772c912908a343020eeca48beb894e62c99c0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 039a8cdd1b7338721ae7b5cf4baa063e45427015d85e10267f32bd5166263ed6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 1481b47df0122860a285e90d3d251456013cee901b534f87cb69e6dd2607db06
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a4bc9cfc801b76dc0a8ba8aaeab5bcd694d9f5ee03cb4601cdf6581b8f8f7ee4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 95442853f7d800ae16a4a3085de89ba7338e7e7ef179f7a3e8a056d718020bc6
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3155db9c2686f9589a7d13dc363a2ccb075f1f446316f0b85292a5c6f124cacc
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 6eb52884525c27a2af24c236524fed76a3ae047f16af9b96d5ec9d889c665cb1
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 1e60c3f38d47a88ec45a6310592cadfc3566634e5c995b927612a70beb3f8b46
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 03054099bfbf054fd4b76fd7d37e499c83dd28ddb83856f2bb8772eb45faa5b4
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a231db08d1105fe9c9c08fbfb6d62afbe1f4f56469ee1fcd670cd56f3c7b1745
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 8b5ddfbadc6467365c0dff9b24a8ebc886d1ea31e7dbe163a90dd703f6d646a8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 0cce3175d8332a3e1349a61cc6f7a7bfa80964184ac0b221a7a57f6e1534df48
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 2d69de3dbca24f217935382991290bd04784ad33cd6bd4cfa9a30df8392b6992
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 a917169a48b41161958731e46642f7e7074bd7c781714e44d7be0e39088995a9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 7bd675b193bad5bbd7c236cbf79f2da97c123f6f806d1e7a25943f8802a50dce
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e6ed36aaabf9cae3b69a05df357fbdb7884f194f0456a78b505e4cd622e5ddd9
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 d3f2636916a68765223c297c64c45f9da335816c194fa673bc2b42c71fa59024
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e570fb0491beb7b7fe4c0ab9e067def48b00c98e49ea88c2072b99e94b2a8b93
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 164cf3179aecf9b3f5476bf0f69b3928cc22c6f385183850dc5863794e9fae78
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 54a296f63f3b0bd72c78979345ecaf4469a39342c695b370c77a43e55b0fafc0
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 317057e8b709f94829663e6bed84c4fedb257653d331d020e1b416e3d80a544e
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 70e84d9a90abc34c6a25d1c21e342ecca202a21674d47654c17bba46c553c746
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 c85c8c64bc7dd9c69de199a8a5589bde47385f1aba66f4d3a1d82268e6da5503
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 32574ec2561b465fee761895c8026222816bf50e5927716676e5c4f3832ca0a8
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 48252144b699d696c630e9d44346d1f165436ca63a107fc6759a6191f440e287
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 e1102d9d46ebb8a2af1501dedcb191c1e08aa57368c8af90f6124413f68ac67f
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 1741b77c31e569df54ed50f70896b4027efa762154c72a993ecd3f2e950229ba
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\SokwUgcg\JuQYkAoE.inf
                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                • SHA256 3598989cf2677001f273b94e66e837c1d7a882ee688a12c142c4cf5ab1f6588c
                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                memory/52-1851-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/52-1862-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/472-2021-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/556-234-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1032-1998-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1068-2315-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1084-1816-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1140-1871-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1192-1825-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1220-76-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1420-299-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1460-193-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1524-2084-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1536-1792-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1796-1896-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1920-64-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1980-108-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1988-253-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2280-244-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2352-2543-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2376-131-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2400-265-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2484-2032-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2488-152-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2492-1905-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2544-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2544-2285-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2596-1849-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2696-164-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2836-220-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2888-176-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2920-1840-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2920-2573-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2968-49-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3292-2055-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3532-2565-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3596-1987-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3952-2065-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4132-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4132-2269-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4140-319-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4184-2108-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4312-208-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4560-1835-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4600-288-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4664-120-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4668-432-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4724-1974-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4816-310-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4940-366-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5024-2075-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5132-30-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5132-31-0x0000000000860000-0x0000000000880000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5132-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5132-1-0x0000000000860000-0x0000000000880000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5148-1793-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5228-96-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5236-1803-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5332-2097-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5364-2307-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5372-2042-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5400-1919-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5452-1954-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5612-275-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5776-1885-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5808-2008-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5900-1939-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5904-1929-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/6116-1964-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/6116-1949-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/6136-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/6136-2277-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download