Overview

overview

10

Static

static

3

2026-10-06...ck.exe

windows10-2004-x64

10

2026-10-06...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/10/2026, 23:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
  • Size 2.1MB
  • Sample261007-3dnw3ahs4p
  • SHA256 8f469adf5c5f0e9ae408b201f88d62be4e956d8f6a7a267a92aea8a212262c83
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 61 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 61 IoCs
    defense_evasiontrojan
  • Renames multiple (112) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 60 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6116
    • C:\Users\Admin\HIIIAMsY\HuggkUgc.exe
      "C:\Users\Admin\HIIIAMsY\HuggkUgc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of FindShellTrayWindow
      PID:796
      • C:\ProgramData\zeUQsMQg\ngcIgksU.exe
        "C:\ProgramData\zeUQsMQg\ngcIgksU.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        PID:6036
    • C:\ProgramData\zeUQsMQg\ngcIgksU.exe
      "C:\ProgramData\zeUQsMQg\ngcIgksU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5196
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2972
          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:932
              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3380
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5664
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4756
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5680
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1884
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5548
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3192
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                15⤵
                                  PID:2848
                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                  15⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:1916
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4252
                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                      17⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:1864
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5620
                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5300
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                            20⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:4320
                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5768
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                22⤵
                                                  PID:2776
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                    23⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4076
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:2008
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5824
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                          26⤵
                                                            PID:5988
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              27⤵
                                                                PID:2992
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                27⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3696
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                  28⤵
                                                                    PID:2020
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                      29⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5764
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                        30⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2244
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                          31⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:2036
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                            32⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:3348
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                              33⤵
                                                                                PID:2460
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                  34⤵
                                                                                    PID:5564
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                      35⤵
                                                                                        PID:1360
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                          36⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:808
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                            37⤵
                                                                                              PID:2844
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                38⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:2988
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                  39⤵
                                                                                                    PID:5948
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                      40⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:1376
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                        41⤵
                                                                                                          PID:4916
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                            42⤵
                                                                                                              PID:4024
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                43⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:5976
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                  44⤵
                                                                                                                    PID:2668
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                      45⤵
                                                                                                                        PID:1684
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                          46⤵
                                                                                                                            PID:2412
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                              47⤵
                                                                                                                                PID:2480
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                  48⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2428
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                    49⤵
                                                                                                                                      PID:2508
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                        50⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1452
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                          51⤵
                                                                                                                                            PID:3044
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                              52⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:6012
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                53⤵
                                                                                                                                                  PID:1784
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                    54⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:1940
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                      55⤵
                                                                                                                                                        PID:3000
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                          56⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4904
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                            57⤵
                                                                                                                                                              PID:5284
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                58⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:2440
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                  59⤵
                                                                                                                                                                    PID:5036
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                      60⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2960
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                        61⤵
                                                                                                                                                                          PID:1516
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                            62⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:1320
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                              63⤵
                                                                                                                                                                                PID:1492
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                  64⤵
                                                                                                                                                                                    PID:4652
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                      65⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3224
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                        66⤵
                                                                                                                                                                                          PID:4488
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                            67⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3124
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                              68⤵
                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                      PID:3908
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                          PID:1304
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:2016
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                PID:5076
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                        PID:3816
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                          PID:2312
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                PID:1340
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:1280
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                PID:3560
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                        PID:1076
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:1640
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                PID:4592
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:1056
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                      PID:5800
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:5952
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3728
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1384
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3796
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1908
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1472
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:792
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgIIosoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:992
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwggQMsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2288
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zskcAUMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\raockswA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:2868
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWYUcIYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KWkQUMEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:5528
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QgwwsAYA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WKwQcwwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:2012
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:1344
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tYkcgAYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:468
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCgIMYoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:2924
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:792
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqsEQQMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:1472
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:4588
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aksEQwkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2992
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:928
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EYIAAAYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1628
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:3100
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2140
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKwsAcws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:3484
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3616
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UwMEcwYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:3848
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKcYUwAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:996
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:4508
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:5800
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSsIMMQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3100
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCgwskEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3608
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:3616
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:5916
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IwssoQEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:464
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:1668
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qOgQAwQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1476
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCUkYcUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3312
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5544
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nGsIQgAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5108
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:1312
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pmQwAwcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3028
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:2952
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsUIAIMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:396
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:2164
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:2660
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYUoccYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:1576
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cGYMgAEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:1340
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YoosYwUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:6032
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWYUAIoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1312
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:4632
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\joMgYkow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rgMoUgAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4724
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:3716
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KokYQYUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QeEUAwQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5652
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:2012
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akAooAYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:4784
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:416
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3484
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgUwocsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:5684
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:1344
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:1200
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUQQwIkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:5504
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:5636
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qgkUUYcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:1472
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\siUcIUAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2248
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bWEoQAEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:4752
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMkIAcYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4664
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  PID:1308
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rKkgsQkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:2476
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2656
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CwwIoIsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:1000
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SaQAwkMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:1384
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wEUAAwIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4040
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lSsMQYcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1844
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PEwswgwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEIoowQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:4128
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:1192
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\weYgUQYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAcIAgYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zOsUgQEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bSQEYcwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:4160
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\huooIooU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:2828
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAMEsMIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        PID:1344
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KkcMAggc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:476
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:2844
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yicIYkgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:1032
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RoEIsMgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:4040
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCYwIQEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:1596
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMAAAEwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:2304
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:4192
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:3896
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cOYosoMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:5108
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAgUoscc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                        PID:468
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rIccgMsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                                                                • C:\ProgramData\kiggYQMc\vIsQYMIA.exe
                                                                                                                                                                                                                                                                                                                  C:\ProgramData\kiggYQMc\vIsQYMIA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                • C:\ProgramData\zeUQsMQg\ngcIgksU.exe
                                                                                                                                                                                                                                                                                                                  C:\ProgramData\zeUQsMQg\ngcIgksU.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\HIIIAMsY\HuggkUgc.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\HIIIAMsY\HuggkUgc.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                  PID:1088
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\zeUQsMQg\ngcIgksU.exe
                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\zeUQsMQg\ngcIgksU.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:2360

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                        Visual Basic

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.005

                                                                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        VIQw.txt
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\VIQw.txt
                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        vIsQYMIA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\kiggYQMc\vIsQYMIA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 07ab294be1704b36c5db96936ad2a3bf65d0d5d8e0a005eec8e8c5115152dc33
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 76750430481e92328c857599b7e04ec35aaffd285fde9d04f1341c8c664c77a8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c1ad4f2ce16d0675a33109e7cc094fd2414290746cc26ad04441e581348c2cc5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 27f47c089aa9f94453f2cdb39d4ee97f99dd105bec09736ba58d10e9b6e2681d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 913d4ccc7c30a33a283ceceeb651efee5328cec2d76d440ed1d103ab39238800
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 997f094768b2ce263862fd2d377778299d8c80006b3c48df7266c236296b004b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f8769e09ed0ecd49b5b84c6c550d46bb09a7fc8a84ccb1f6b362c02805993768
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 217f64f3970deda9a92cc70d5a7310bde74d679c3ff95fcd2f13e3398c8d2b84
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b20723086bad2b4b9f8ef5f99c26ddc119f843444cce67e525dc6ffbaec36c09
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 893fe4dd53dadeff05e75603f138e26c9464494c4c4b8db4edfe0b02fe8ba068
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4dfc4c24e9977aa01e0b5fbdace41d52891ea4bc5b15bc3dbab78894fbdc70b5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3ac1615925c2ac17e73c95d7fef821417fcbe74e24ef2c352ed695eeb5a2d327
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 055bc0c69bc55ac3653f325b8082da170ae6aec4f35b985361ef4ba3c2ef535a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cee62bfd102da1974196754b859d8c56a11e46fccc3b37be7baff149a512b4a1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 498bb2177e4690e85ff7a28b46e753edc110e5ca0678ecbaa541b19bd830c077
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4b308c39e77b841b272561f96682620dfd7d651f6d1319c1644fb97bdc80ba46
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a0a4093252b43a69e65c13695d5996046ae77b0eecfd7678944981c79270e200
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f328e6b35555f449aedd25a64ce554d31668417b396c271147b42e07246cf747
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 59c104359dfbaa18bc0117d5ef62e0d7307517f9c61c3e333266e9a2106fee76
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 89dc2c1f7262e574ea77a209ad23ac83bc5f881d32d705831e9b06b0b1e4f542
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a2f565348a9e47d8a138192a02abc6c496da9448cbf4be0a87e06e7c8e3c24c5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0346c18b09056e894a93c561ada0b6fd6af4798321f0b045ee9edf71f9da8a8d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 dcd4c6cc1b8d8810ce8a3b658f77096c91e7909bf0e977e233d9cb719a96a792
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0706875c41d2694a9add92135ac28d24886a848df3680300e3817be969015e2c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f53811dd55fca1e1947a6c139b7d134b63231188c404be4e01e0e8026e2fdcbf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4c38e218e0f9716b07ae7ec5a4c7e2cb0e7f960c9d615fe4db398839811f7ce6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 39ddc00dc0b4938e324286a40baf9ca29f37f5fbcc6461bba8d09f0c266adeb7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 91b81ba6350929414b7f90916f69c54e8087e0b11abfb3e1f1a02c9a3a203978
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2943c3c6374b5c8da3a65ebbbfcf4ccea9fa87f2da91f3728edbe9117b32ffc5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f5f9efa372547e529c2af3e8b543c382a04d3c00777a9a048507b28197fe0581
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a8e781e94170349a64077fb6d9394ac827366e12dcec6c64ca03ba6663f82ceb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e78b3120a149b68026935f5752d4146f939dc5b182769df8a268c9f264be10e7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ad38b3869c5eea25f5de2d3b070d8ce50d6f6e65bd53c50d59dcff7c68dcf6ce
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 78f9569956fef54e41976f3ac0552eae241a8e648160d33815660f4d2717bc2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 36080c818c2e8a5cd9ae95de5260a2b6bb60f88d2ef8b10dc99c8bc3a1441c4a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f9586f58a447122644a2287d6b257d54c5f701f16c5b7c5508a5335ef0717f7c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1aaf7996674ed59c9ed39f8adeddb2b0bbe1b5e2e6f9169a21f88b667644ecd6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9d7e99b779a9b963a8b6eecee81a1c3282d8971dc1410ce36e914430cc561405
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 099978b5493f6293357e61d4298e76bd4ca7d025f278a4e1412e8c52de7108c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 37dacd1d86f69c0e339e40298a3e5d50224c13f308acc9671308bfd5da021648
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 234416262f458a61b4a6b0075c3b42445164894a4a0574337a2fb8ce3ab6140e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 91a91053bb7e80910f870543dfdaf603da6b399f24f5971a8c15bb85c503d9ab
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f5d746fd8f41c58b29392c80aa62ddb7b000b750bd6e45f7b4e17ddf27ceb6e4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ad6ff8b154fa29ddcdfcee7d689d4d73680c1a53cb7b25f2ef6676ad09303868
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 923fda16930d33ed7620cfb711b07931eb929492e0709d4527f1a380657c8d2a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a311405d291eea60446e7c39740afbbc1ab7e63c489e9087dd4afa6275de6c64
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0766b3a130f9463d8798ab94c64c183c0767f88026b5ee1830ed71f75a2dcc36
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9eab7b89e2d8cc3f979e7538a86bca4d23ab0414a2d3016739f6d707a7afca14
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a58e6e5380f9e30ac41f49f62c5b4d9efde1a9b5eb85615d6336817dd376aab3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4d4c5787a9282da6ba44ac85535a09bd72377da28f6d00c49fa41a5bceaece8e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 75c7cc3d8626607ec12986a16977fdae0000cc869b7ff501b87b10f1af709dc8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 92c1527fe8d8d9de341568fd4f69fcc9b6ddfa72c59e53f462e5af8b3f6c162b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2a1278b0e8330779c9dd68bd79ac80a37800937d5f05719897ee8455aad175a0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d13a5f76d5a12dc8f7c37cbab280118ced713a1541b40102477efed9bafec36c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1fba8f9e115bc87a4693191724440da4c143d85fa2d02aefa64238e35029ab9f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 33e2faec382824387272b36bf00e723827f38452731088053c7daac4b1558f5f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5c2ff197fb1554b3ba02918c7732e960cfd9e3b43d41edaff3a63fcb78ddbfcb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 35643b0e141e2f792f3587d78e02e94f0c4e07d079dcc5c381463b19e669b4fd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9356009efe9af489fed2046ac3de58b68e7e6dc011502edcfc18099e2a432bb9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f58e465a4f954a8ed5c15e8290612f037b83a552b15bd8718fec075c7101ff5c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ac260fb90c60ea6de323bea74e16da2e8d267b0b308d093483f21a67e09110ac
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 23eb30be6249d2dd2e685d722a767d6923eeab31b7111abf0916af686d790162
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4ef880f612a03c808ffc6a32d8a839a5726effe73e0f55ac2e6174bd987d0a9a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fa9293354073adb4a1e1bcba7bfba6e34cdce3e6d3d57e317a8dede09cc98585
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9c8d1ebb30cdb7fdcfc86ef31736c36d02287a2e0e41bde42fb58a3bc77b18a9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f255f282d756c880eb7b161c02959495e1bee6ef5170a91479d97d776a5a3435
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\zeUQsMQg\ngcIgksU.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 283b12f88b3938002deaa625fe202459e6fc2a7bf88fd792ed9f826d07798ce2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-06_91aa3c550a76578f9cedc9559d7dac87_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Size 588KB
                                                                                                                                                                                                                                                                                                                        • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AEso.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AEso.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 19582c8ce0c936ffd051d0e6cebbd9f636b3ce77aad0205e2ea24e6ebeec39dd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AIwA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AIwA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ca677bf23b6448a2537ba384523723b920dfa05a0a01d33ff0529b559ce5a0ab
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Acwq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Acwq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c3877928f41dd06ac9577740f82faa5d0568ee95f7ce90727066cf2dac009441
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AkAi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AkAi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9e1ee09e5cc43f016a0b5eae24344776481952e173f1099f6ecbf5e3375ac66e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Akcc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Akcc.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 75ab36eeb86b023f28b8da51d604d57dabc46de6fcf3a344dcd437a88912d3ba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AosI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AosI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1d7b31e09285909a09ac04341eea8da2ff9e0179fa5868b08364a7fa9cdf6d8a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Awks.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Awks.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 00ac171c910bc4d792fa81a832d72e67bc4e4ce296e032d7b21f220b8db465bf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CAcA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CAcA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 21987fa3f5458c54ec2d95bc796f76fb326f1ea389e9b885ff0b9eb63a33988f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CAkq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CAkq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4a3123fca878cc77fc26ac97846d1220649ebd3a3bb9d5ed86a808ee838dd4e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CMMc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CMMc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2561416989f0e958d8837cc9f77d75df3b8c422c2ba2e31fd0ef5766ac4e2af3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CQgm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CQgm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 55f78620ae850c6c45034c3164bbfb8e888640911221856df87e01a3e16433fa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CUoi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CUoi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3a5420b95567323731f7415dc0119df290558b9018cfbe6ac0478f2853aac6b5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Cggc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Cggc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CoEc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CoEc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 65e8f7cc2dd35f1f46e665f532198b5adaffe21aae686a0c1c38662b2c7db556
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Cwce.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Cwce.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 45daa3025e92c17ca1a514e916b2d1e1be0041e26bd3ac81d48d462a9ba78611
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EkQM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EkQM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d9020fec22bbe45548b466ef54f126d3ef3d80df8a13de1c7359034b39bc7aa2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Esci.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Esci.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 70ae6d88eca7f6437a3949c2f8318499f9d81a1a79571fca59e81e5c2f61942d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GcQW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GcQW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 055729a0302501a0f7889a4e3331271453fdca09a41d8ffd005e6c39f52c2fd8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GgkK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GgkK.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 24eefa9cd37c1ddfee86eb6a879f83d90bbc22c95191063bf5f9902635f35f16
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GqkE.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GqkE.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GwIg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GwIg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 eb1eab817f8e7e1a03aa33ece7189d638ec393e7b416fa628cc2e584e1c4b760
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IAQu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IAQu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 68fa533a07d59c76149a689d0c9fb18ba373a9ad282fdae1e159149ff79eed30
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IAsy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IAsy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 adcc6b5acac0b2b33c6734719a777e0b610f569b03990eea46786b53770e36a8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IEAW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IEAW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e74c8dfe17425389bef6d4a51f4af531f1862a6c0fb2893a8fa37bcbec78b4d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IEMM.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IEMM.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IIUi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IIUi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d14a7604c26cd94f3648d2ac3097670eba2847503708e3b2cbddb1d551b4f4b6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IMMY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IMMY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0def251727a989db8dde4641fe2c2a5bfc92c8f9e494859c4a66755a8375c98e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IWYU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IWYU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IkAY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IkAY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1c2aa374138f1c6096503687e8ec2fdc40701ae7ba606e63654e8cd8d13b39db
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IuIs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IuIs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Iwsy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Iwsy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d692a4e129f959f662cc8157eaaf5937c6cd514af060c99bcdcda3e87ef71b7c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KMES.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KMES.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a8aa7684bbdc797b49d50ba1677fafd862d2db035eb99b35c65ac80aba91eaa8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KMwO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KMwO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 477dcf78c7ee6d099d8a63338707556f87b309716785ad2f8d4e3b75038ea163
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Kgog.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Kgog.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 651f06121ab9ee03079ebce3f43bc8a93fb118863b9d4644971321458bb92bd7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Kgsq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Kgsq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d9baf3427f28b1637eaddf2934e06c9f57b45ba522904a8690eeaf821b7e040c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KsYk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KsYk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 86513b06d418251437f5c8ea202e42ae0fec2235272753a2480ad21b920d1078
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KskG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KskG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 341984e212acd6879f18b10fdce4ea3c27ea0b09fcdff899627fccf75fc1ba22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KwQg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KwQg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2c75134a24c92e388d2496539816654d7dee999a71d59dfa315b3c05ddcc6ba4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MEIo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MEIo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4dfd25880858e18c0a63484efa58abd7a6f04484c1a2a094a82d7af914da0b77
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MQgm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MQgm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 709806a2e0c05191bd20f78c77f312bf3ed2c4ebc7350b3787dba2a4f49b335d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MUoA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MUoA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Mgka.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Mgka.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 03d3aee044205fd52f7165b55043ae5b32ff77431674718cf166124df483e980
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MoUc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MoUc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6a7ed3224d6cab2fa98a6bb8dae93b13032ee658b545c742f2f68243721675a4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Mowo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Mowo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 31d49c92d4c0bfd53400c038382cf7e59ef5394d4a68bb99bdd29fe87d989bef
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OIgu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OIgu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 02aeff68fad402af7a7ec7e983ca6ec6c1b7b05cc229837a1ee01b2b059b5e7e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OMcU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OMcU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c6dda4858d2973c8c9fdd16fd72242f8268024a365d9634aa9e1cc6e10cf87ce
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OkwO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OkwO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6e97ec647456d00fe7cb1eb705c2f9a31f4ac30951b335ab26f13e6fc63f28ba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OoMM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OoMM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3465204ab3a584e0ee922f2f4617d457a7451b394ac7a5731c3b319418e98227
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OoYo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OoYo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3e80d0d249c9886b6d0b01704f0b5ffbd9cc52d16cad6ab5f434373d0f0058e2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QEMm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QEMm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 798970ec66795cf73ccac97e74af66c8feef3d68c89034b72d3121814852dc3f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QIwI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QIwI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8ce45015041d317a0b485fead55a2c728fc79a1e66af27cc19f435a0f7b8b298
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QUkG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QUkG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 be4fdb6198a30409c8a6f334c81df755716f603b0e8093af7dbf617b2ee0bc73
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QoIU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QoIU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 48a7cbec67ee4106b0db0c157b839fef481b4b4afdafa7cd46c4bffd2b7c83a4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SAkA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SAkA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cea681d47ec23fd765d40d5047c0c9e9bfc44f0dd8d3b8b2653f978214a0fa55
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SEMa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SEMa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b3f270f373bb9e82c3b2a9c0dbdbe1592b75cc400595d017bf22e31b6a75e0c8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SIAy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SIAy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 aa97f50a148827fdc31dc98467768b189fee3a12381b7f514498e7d28d1a84f9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SKEQ.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SKEQ.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SssS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SssS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2843d60f5abc1b56d818868c0e48d052651f025233eaae9ab5af36fb1c79054c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UMAs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UMAs.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 27fd2bdfe99a87acfa0d97346e4cfee1f51136a519307076c98dedfcd0f90272
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WAsa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WAsa.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f5776f8d96742d1dd3126b46b695aaf9d60763bf516e8096fe607355de1c0cc2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WEYo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WEYo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0c07d5aae4c9aef0ba0b9a6bc721f9ecb552526cc6a349739bbc86aa1c65c407
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WMYC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WMYC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f37d0e11466d93d353c80da60b282093d3ca25c7184ae1b35f3ad4e30f303f1a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WUYU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WUYU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 defa965dd3dbb185ad05cb4384300e68b7ae9467b29221d026d1a80e0479f044
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WWUE.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WWUE.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Wckg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Wckg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a74db7f31ba4656375edcf5806ccc63cd433242032dfdcc24a4bdc502130088d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WsYA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WsYA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3bcf3926a61f4e304793803fe61e3bf41cb516405d0b1aaccf82d86052d08161
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YEwu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YEwu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f53126c99a4f410c6d02cca6f3cee7aa6f4eb4723fd05838a7f7fe9d97a425c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YIEy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YIEy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 919932abdc148137319e15ed96438db535f78ec193a6e8a027aac9b24dab962c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YIwg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YIwg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YMwS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YMwS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 821db8e6749921f43840b3ac594de91203ad67bf94a8ef0f0ef421e6a29ff2c5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQcG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQcG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e320aade46354ce9890afc4ebf2b3c2a3b11779e66bf2e0f4e403fb31d3b5d6d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQom.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQom.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d97017c2ff6d7aa2160dc57d446da0b00adcef91db910b88423cb3a7c04d20ea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YSMY.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YSMY.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aEYS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aEYS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 26f554b32165d659a5d50d0199d18c4aac115ea0afeaae7659052c9a453b980a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aQEO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aQEO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 66baa99fc96c7b60436f1b73bd6c86a075f722798f072e190b3902cbf113fde0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        acMw.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\acMw.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cUoS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cUoS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f9c4b76d341bf61b806a597d729338e5772f333cbc9a70b69a3a56b939ba72ca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cYAe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cYAe.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d6f9137789e7bd62b371b5880498e06a4a95a0210b90bf729c462bce12161cf9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ckkG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ckkG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 faf92afda7d86d5444b291178c74a6fa870b4f35992e6fc9c772b1c3691cd7d5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ckwe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ckwe.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 74b9bf84e43ac9f04d9317ba5868df66a644223e6e99c2bdc9bc428a8b0e6ec2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cogy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cogy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 18c387990952c7ffc6d7826bf55b1e14d6b30b611d80affd1804a200f5c0bd77
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eAMm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eAMm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 256dffc4fe82c94cccb898d401bdaff950f6907c274657ef9e329cd2f92537c4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eAoa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eAoa.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 034ea16e7be350fd2bc560ece1c4142d14214dd8d6e9fefb88976d615221a51e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eEwE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eEwE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c2fb0e3139f2c16d78405b9ecbca75ab97c90dd86ee9f31101f03010c0816f7a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eEwk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eEwk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 50eff063ba15989a06d7045374f91ff9dacd32b8dcc18bfbd4af0768026edc6f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eIIo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eIIo.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e989779588b5fa28d38588d1ba58ef92219b4633e333c24ac6b11850e8dfd1b9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eIwU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eIwU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eQws.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eQws.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7ce22fadf596914d80f151567f4f083ef8bd0adc68e2d36ba23bde036675459b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eUMi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eUMi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1a36f8d03afabbfc96216e612651873e9745b2659c44c3cd5421549e063944e5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ekcM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ekcM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 abe942aa4bd99e579309f8562afca758b5e84f069e3c6cfd38ddfcdbd14a60c0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eksQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eksQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 12c4b0a66b73f9ce3a7140510afd4a2cd5a5017dc0ac2a2a58b9b419ce56e2b8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eocM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eocM.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f6a74d0f26d447615d7127a5d1c84fa74400ca06ef526c04de05e9de16231b0e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ewYS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ewYS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 be009b82069c9ef7bc85a4f5eb3caca94628acd6a457d0e0c236fcc156735a64
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        file.vbs
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                        • Size 19B
                                                                                                                                                                                                                                                                                                                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gEUc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gEUc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6cb23f4932c0dd55ae14cda92720fc23ce6e766e9c60e887a61ffc0852351966
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gYEO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gYEO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d5f58b96401c01dddd4de0d11babab235b463859f91aee378056982524bf9a43
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ggMk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ggMk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 187cfb61515c02295b8ba71cf34748dc8f45e2ca7db39e61e94ece6a303da0ab
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        goAS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\goAS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8853711c0147c5ad9d0aa7ea637bf5526800943d7bf12f9c2a12b66cb9f90f1e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        goou.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\goou.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ac1dc91c191d2eb56ed3b0bf454bcb2013fdc0abd1ba95f4e838217f07526855
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gwoO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gwoO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b6debc2821b755812f68112d73cf98c63eaab77d7c1044f832b7ccadaca80911
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iAYE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iAYE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 aae4c016dffd370faadd339bf1025281b56d3987fd90fc1713feba89821e67f1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iSAg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iSAg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iUoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iUoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 18a8f58ea56f6dd3d81bf2ea5b050340665e318ce8905b1cbd2a2ea0fee20f22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        igsy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\igsy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 311e86c64f579d5bbf8905c7c830bf1874317d18dd9bcaa480d68ebd35cd86f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        igwu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\igwu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e55e25679b9f8b88ad80381eafbc8564d5234285b2dec16adcc141c99bbf39d9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iokG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iokG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 db534397ede716513f9cff07492062cda1586e417e72754d74f2daeda715cdc2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iwUU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iwUU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 609b1c808e1ba443c9b27794bbfbdf940d253a83810a9d15e18ebafef5163ba5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kAMs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kAMs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 36240621e189558ee857ad68ed5a42a1698a9354216935238cd21506a67cf299
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kEkS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kEkS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 639c6e6b0c9148b793cdb6c7b23e2cf7f4b3d732c9ab97d7ab38b17cead7fa76
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kwMO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kwMO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bee7d42e983a2e9ebbcfa1a6e7f1f1938a27508271ea5b809c2185375622dadc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mEQU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mEQU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 44f1870230dc3d0c6c69b690bfeabf1244ab5feb11ed5d64c0fb6213ece94e9f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mIYi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mIYi.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c02ec83647c1f6470906883e0880a5aa5f1af4d470517afdaa0a8a2f3e239a2a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mMEq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mMEq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9b9d0ad499f6691cfe8e6539e654fd8c3a09c6ceab705086b792175be3a75cb8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mUcw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mUcw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 38147a2c5b604e598739d23d9ecef7190bc163cad32247b5fa8320f7867f9c14
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mYoC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mYoC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fc284c9ae5b3ac44be497b4d38bdfeff3610bc38a3529d9a59435b47f044af62
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mYwe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mYwe.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f744d9e4cb84125712ab85efc3497e89bc0801568090213a2269f2e467090146
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mYwk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mYwk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d086d4f5f01382a0c7e7b466962ec757d7c6cc4d94a68b3b3187af0d5f2bcd3c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mccG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mccG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 20bb52e6fbeee1ea9fa3def1ecef076373249a69aa466144c4a8d552495d8883
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mgAu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mgAu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 443f80fbba0263156ba3f2281d2622c79538d55277cd203597915ee5a7fe322a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mkEo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mkEo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 299bedc51141c90ac99aab3781e48af6fb943805d9d4a8e3933f458518060443
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mkUs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mkUs.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 80f879a23bf91410e26f81ce90d7df0d80005024e974dd40793296d9b03b8cc6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        msAC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\msAC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8b93aa99eb31b8ed63befda58eee1d118b476bcaeaa8a33e35f45f7867d4ee25
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mwMO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mwMO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2d00506b031a558e2eafcb658bf1f0dc24a5cfd6723a72a87ad5299169fadef6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mwse.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mwse.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9bb4047609987c31d352566d580b57be33ff6d6a12d7b2d27dc1e01befb263ee
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oAgO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oAgO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a428f99b6e59d4b67d1ac218dc12efe69f3f45cdf73783b82e56c72b68332f20
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oQUQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oQUQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 37c5baa711a2841f794fe2f9f1b7e32482625ccca760e56aa27992289a067d55
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ogIY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ogIY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 88b053b564dff5e1b9dfe913715e436ca32ae49e2adab8adfe5d321f8991189c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        okwk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\okwk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6a2a3818f21821b0fbf20506220f47a55abba598b6d299dbdee8ed072b4289e9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        osMI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\osMI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0d0bba00a08405395d19c12910331b319c4978d93ca03b7cef7b5da6932a0ba0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        osYM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\osYM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0440c36b59e2cc6585eaf7486ea831fede208f3ed416ba85d4d7bee16ef80956
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        owce.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\owce.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ce11181f06ec7905ab900345f2eef76b2804595f44a00f84b602a77b95381bc9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qQkm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qQkm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2e275aaa11b3ecf30596a816448502ce80165c5bfe5e76f839a530dbe301b2a3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qUEQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qUEQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3f3dddbf8f3ed11c198aab5aa032af455f79b2da91a7b28e009d871fb6b52b70
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qUYY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qUYY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 67b9d755eda2dc1f7ef4c3de01de3cc96ea6c913ab72aabd935b8f0d041a494a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        rIccgMsc.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\rIccgMsc.bat
                                                                                                                                                                                                                                                                                                                        • Size 112B
                                                                                                                                                                                                                                                                                                                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sIso.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sIso.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4c61349859b83ce3977eb65a5de58370527d89b4a6d1f05da7e14f484564a3c2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sMgA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sMgA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1cae55dd85a3fbe9407d551db236902a90ab3080941e1c81571fe58bd5b9302c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sOsg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sOsg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sQIi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sQIi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6ff5bbb4c81df9dd63a190129269409e38fbde70f1fc3504eeb4e2f6fbdd1eef
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        smso.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\smso.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ssMk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ssMk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 66d6b8982d1a64080e395a71ea97533eb54d38cace5a0d50d4f2952531982788
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        swcw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\swcw.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1ffbbe6dd476e0371b05164f559fa9948ab4acb72c9318e475173f07060868e7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQIQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wQIQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5534a5192968ba8a0c0f6f071e7d34bf6608d6fae76952f4b4d7203abc812141
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQoC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wQoC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1120f13045d6ed7deb9e4a65e45c396c038ac204a53cb3cd8a7d3cb630a3f8eb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wUMm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wUMm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 db800c9de51b3bea5e9d062dc064b5227a3f5541d5e241a8da1b24a62f982f27
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wYgm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wYgm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cfe8cf0bc34803efdda07ae504f4e30c3f4cbb63f18c795351804bf707ea73b0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wgoA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wgoA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6bf620924eb288a5da1df7a5dc3663b6e1dcce34762d738e537f2347d5dd43f5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yIkq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yIkq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 129fad42b5bc3e93fed031ec0cf2569203cd686c1e7b4bfaad3dec9d89eed860
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yKkA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yKkA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMMe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMMe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 27dc3bd2f0096973e0afda39e60344e80e9c36b99578952640cddced3d12815c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMsg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMsg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 12992decc61ab7ff0b5abd7006452b43ed6a1717bac92d929b9461c8f74383f9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yoEC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yoEC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0b822df5149bd762f4f411f344be61d54b2cb0587ee93c7a24830fcbba8269e0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ywUQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ywUQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8374edad115b1d38c7d5b85c710063f166c26571fabc39dd31ea0bc8eec75ffc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a31cd775c5b5263da7768bedda877bd69d52b8f62b667e91f3ba8f4d95a99363
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bc54a0ac4c741857aa09da5ae208dc49c420320dafbfc22b503f24e6392833be
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b31321a868bbfe7bb400bff8b39a360b526ebc2ed46f1005f49282ea01faa6a7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5f8fcb05c3ea8d6049cc3a2a6a3c9b271fa43c34e7f1921b4acaead31985ced3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0ad7a3c64207d986acfd411b3742da9a721121e8df5d729ab3d051f3f10e7abd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 78fec3d0511a5ebb27eb48f014ef4ba9a3c4e77c11f7e6f76f0ca95105d106e1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 2aaea531d4f7ab120ca8c1fb316a68906da18402be6a4cc5822d0d8e6d3ae863
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bb7f02df585c8649241c0ab34ce215a0dbeda19bf54624ea2d8e5df51ffed077
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ac3456dc2092ca11527982cfad6ca83ebae2340021051d3befe51ccc16e257c0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fc89cf7e78d3bb17826e211f069c74b46542196e00bbc52057089ba47cf75536
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 638932c65ff9accc7f7ee6f17cd43eb47c1b5f6da5e67c36926d066f61619add
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0d8017b51f80a54facdf505303696fb6d7028e8700a35b553dfa45f3930e690b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b636a364a952af13d52fb73c0c12f94484b81446b2db8438f5c189f59068da38
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d24a6ab197039a952656d69575357d65efb49fece5aaf89edc63cc24e34825c7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3054c62771ca9cbe5ad0662db4adada33aad81349a230761a15e1171d98bca48
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 451bb8b7a6108a272e9e00e647995f29f96567a742e26b65c81ab9895a2260b6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 596010ed3aec98a03d0b1a52fb9caa7f63cc05b4bb14f4e55d4d1eaecfd37f86
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5f81bed2a2a8a8efa6b54f498a72261f03c83617fb1d4ad281967bd861035353
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 7fb6810ddee4628449c881a63287b1af83e1aad4fdd5ea53d9c0483fe0ae62cd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 829fa77e344645a63bff837b4583fde471ef0383287d4d6f676fab73972f848e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 08edd747cd2e6d429bc5b21a1588b485a9bcb75cba94dd945b940c5f0e1a1525
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6e749401462657068869dfb33ab0c248c159345e0e6b678e4079af1d37c5753a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 484b4397e2e95c0a65f46aeb7811ffdaeb4dd55fe41aa69a87b87a485fd424ed
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a5739ada8d73b7523a9114b916b8ee8b82496befdde007d40f6ca55479dce1dc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d9a682ef206620044ae1f52549f3117bde082a0362eb0ebc07e9bee6298cf061
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0ef9a0880a2bae8575d6e2be22915e5098f58b03a918309a06c52669c8401fcc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6bd0d5a2422f0aa87a24fd00b07abd0639670febb082560df94a9abeceb09a8c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f5412006b99cb7e28755242c3917dabc44e97052e01b9db82355e77c8a8b57de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cba469684c56f33e3601af87e83c55e6f405fe31a9a47f278360355bbd5afa8a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ae30cee5615d6e2f107acd1ba64b8a79c17e981a833806d48b9c3b9a686c35e8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a141ec36fc2e8ccf43131fa4a9d713c86d48654ed27ac08d44502d8653e2a8f5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8477f155c4b210a64d6e7e41025edc4cf084d3d9ca85ebaf908e09236d1b7bc3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a996253153a4f00b2e82ce411d7835a4f019a3bb8186906e222cdfab2fd9642c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 256f98894fe86d29d6f8d2c73017e9190e54373c5779b7eaf6ba76842061f5ea
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 911c70675ae6b038571fb3417a6284fbbc292ec6f0ba1558758fb88ec25d5e6e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 97741e4a218715cf3e03a71169462b464d33b46d0c6df4a633bf71ddf236a767
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d53e658cdf65f28be5df07b1c490660ef7275dcfa956c3e8341b168b037f9b74
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 05edab577f83a98dd68bef36f01e0f2f21a80c441baeff9c496ab79c4c171966
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 50e365f5002715b4276affe3d49896f17c0415f91f4906f7bac286a2274831cf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d7650ca869a8961bfc7876e05990b7bf6cfe27c1efb3689184378b9fa960b6c2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 51affc2d4e758eabb0258306fe87c7c38c478a405ae31766a8bac4021fb89971
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 784e5e0a2da1e8454a5434957cb4426943d9a68cf3a982b3407c82ec9611491a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d59c420b1cf8a2db7b0010fa6a7106b7e528a94a4da43ba767887c3d6918a8d5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b68f3cafddae4877b96c4c1724cd18ee96ada032354dbf7b86ae550684636d8e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a9e80f6cefe6c4df8618adbeff20c27bb0b4a868bf7cc9d720a5ce6385deb44a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c266ab5e4fa8f01343f945e00d1b0af76d316cf7ab48fa42da45f2f230e4c75e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ed5dd29dd842e5f05cf217c8c8c63e86892f4f7fe09011f129b85c1a6d40f6a8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a3a86e1d40f0c1b5355aef8d1612d85fb340b38d203586a6256a24c86d001a50
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 395a66f4d4cee2cff59e9ef6ff7abb378f8d83780f6e11937cf9db114df6d1da
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 25c3717940ece7f281fcdbdea81cd624e161088f4710a4ca1d8f52a007e88287
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 78dbcfb235dda32f7cc1e5c700b8ce145a514dff0c146a6ab878cef2c65e8a2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e29404db70be6e6e6e67d618fd7639c3177e28050114e9b09b149237a103424c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b61c03fdb61567b8245747eb0b93af94e86fc90e317f5739fdec20e3362e6123
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cb6bf0307d0f393a32d1cabb7752295ce01eef684ca2d06312b94837e7b6ca98
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4f276efa5083c8e515e4ce3107defa35715c18a18244a3ca7d634eda8ae0d759
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 19e87cdb319d21c79cee5502c633605d907ab112353533de37a7f0ff39563f1f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 057b67a5d6ae700303cf5ec3c60a0adad332bd7c7173745b9c66cd2330fe19d6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ff3f269dea4a7438e2ef363d08b7c441302f23a15342d4f90bf251eba214b74c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 54b040f2514ec09af1b5f1977778827e56a06bc6de2c1a7339f705c430c9eeba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e41fa2304b6367318fbe96d14de4f3bd25c9b113d562e95c6b8d0aaec0738e24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ecc74e38c2b1ede693eb882d2dfc984e6c08c4a6c83cbfdba95553d2b350ff00
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 42f0c6679cf9fe025c989859caeec046592e245a273632e3a3b188402452138f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1013d9d9ce243d6fc1025a692e39ac80f600122f9e4483e7710c5cc2214be0a6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ecdaee6cdb0529e5959e6a25fa98c0de895ba63b4ed7260b02f8c6c3a7f30383
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b03fd76b02b8f38f58b666b2855150be8a2dec7cf0aa403a863ef59fac72c69a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 caf328df9caf4e423747a1e6a749a35417de45d3316988cc68ed61355dd004ca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 264f296b52f7f5a205b70d0cd71d866495a02c80db94aa68e780c50bf918f8d8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f1683123d1f477cc36f231592c70b8daf360bb2063807e02a9568acad47ed717
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\HIIIAMsY\HuggkUgc.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 147ca4cd132bb04e1554641c5a51cfe84fb518ef14cb92c8a75759f7146c9b9c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        memory/708-108-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/796-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/796-1853-0x00000000021E0000-0x0000000002200000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/796-2359-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/796-303-0x00000000021E0000-0x0000000002200000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1088-2381-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1360-267-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1492-1915-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1516-1901-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1684-1813-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1784-1857-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1864-152-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1916-140-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2024-2380-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2036-247-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2460-257-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2480-1824-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2508-1833-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2508-1820-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2844-279-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2940-2373-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2940-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3000-1868-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3044-1847-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3124-1935-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3124-1922-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3224-1926-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3380-82-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3528-50-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3696-226-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3908-1950-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4076-198-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4276-1946-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4276-1961-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4472-1981-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4472-1995-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4496-2538-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4756-96-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4916-300-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5032-64-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5036-1892-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5196-2366-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5196-16-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5284-1881-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5284-1864-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5300-170-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5324-2008-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5548-126-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5644-1971-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5644-1957-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5764-235-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5768-185-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5824-214-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5948-288-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5976-323-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6008-1985-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6036-2575-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6116-33-0x00000000008E0000-0x0000000000900000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6116-32-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6116-0-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6116-1-0x00000000008E0000-0x0000000000900000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6120-2018-0x0000000000400000-0x0000000000625000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download