Overview

overview

10

Static

static

3

2026-10-07...ck.exe

windows10-2004-x64

10

2026-10-07...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/10/2026, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
  • Size 1.6MB
  • Sample261007-pew26sas9k
  • SHA256 0ea6c99b70a9834bbf96ea9efc2689d61ef7381be96f52ff90983fd1acf378af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 63 IoCs
    defense_evasiontrojan
  • Renames multiple (123) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 62 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\WkkoIIwQ\LSsQEEYI.exe
      "C:\Users\Admin\WkkoIIwQ\LSsQEEYI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:1164
    • C:\ProgramData\jkAgEIsY\RmkcMIMA.exe
      "C:\ProgramData\jkAgEIsY\RmkcMIMA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of FindShellTrayWindow
      PID:5888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5804
          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1372
              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3184
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1084
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5576
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3980
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4600
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4532
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4332
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2876
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:5152
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4172
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5592
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2400
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3984
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:2684
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3448
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:1808
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3416
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:796
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4272
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2160
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2708
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                            29⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5140
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5492
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                31⤵
                                                                  PID:3392
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5468
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:3120
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      33⤵
                                                                        PID:1560
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                        33⤵
                                                                          PID:3436
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                            34⤵
                                                                              PID:1196
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                35⤵
                                                                                  PID:3900
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                    36⤵
                                                                                      PID:3028
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                        37⤵
                                                                                          PID:400
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                            38⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:4744
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                              39⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1872
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                40⤵
                                                                                                  PID:2448
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                    41⤵
                                                                                                      PID:3780
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                        42⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:916
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                          43⤵
                                                                                                            PID:4680
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                              44⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              PID:3716
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                45⤵
                                                                                                                  PID:5256
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                    46⤵
                                                                                                                      PID:264
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                        47⤵
                                                                                                                          PID:856
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                            48⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:2456
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                              49⤵
                                                                                                                                PID:5132
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                  50⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1732
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:4380
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                          PID:1880
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                            53⤵
                                                                                                                                              PID:2432
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                54⤵
                                                                                                                                                  PID:2960
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                    55⤵
                                                                                                                                                      PID:2724
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                        56⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5996
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                          57⤵
                                                                                                                                                            PID:5648
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                              58⤵
                                                                                                                                                                PID:3304
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                  59⤵
                                                                                                                                                                    PID:1620
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                      60⤵
                                                                                                                                                                        PID:3020
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                          61⤵
                                                                                                                                                                            PID:3348
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                              62⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3368
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                63⤵
                                                                                                                                                                                  PID:4884
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                    64⤵
                                                                                                                                                                                      PID:3464
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                        65⤵
                                                                                                                                                                                          PID:4696
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                            66⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:5916
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                              67⤵
                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                      PID:124
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:5836
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2460
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                  PID:5936
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                          PID:3084
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:3536
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:5056
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3064
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                        PID:868
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                            PID:1544
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                PID:1524
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2060
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                      PID:248
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2528
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2344
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2056
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3292
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:720
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ciMoEQok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKwUMAEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kUoUcAgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEUoQYYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSQYQkYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RiYsoYYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwosQwwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWgcUMYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SAgQkAYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuookQIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XqoocQMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RcAQYEEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSYUoUgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OqgsAUMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EMAEgsMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:360
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKwQcAIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akkYAocU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nGQcggYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQAkEQww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FgccUQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cuocgQMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ocMYMkQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUswcQEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMUYgEUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xKQwossM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FacYggUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jgsUgsAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:2232
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5204
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmQsoMkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2268
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2768
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:6096
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MYkYkkUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5928
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5460
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ciEAsckE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYsMkoUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:1384
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:1520
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xwcIMgUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3408
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5308
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lSIQcQgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:3800
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vEkkgAwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:616
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gEkgMQIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4904
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iwIoIYoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WMYcQMwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4988
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DuIcIYsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1860
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2712
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\laYswkII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2536
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HiAcAMAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:2144
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:3268
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ySEIgcks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROskowEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:428
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1812
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VkEcEgMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fIgcIEYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWogsEIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:3332
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:5588
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:2832
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZScsoMog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1832
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:4180
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bWYoMUsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:1624
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:4372
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JwEkEsgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOUMcMoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKogYEgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:4708
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:1892
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OEAIkEUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  PID:3188
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LOoQwMQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3976
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3064
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                PID:3380
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZmUUkQYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:3452
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWcsEMEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3784
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omYQUgIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:3836
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:4080
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                          PID:1920
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:2536
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kYoEIEIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ueQkQQkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:2224
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:1548
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqYIwkog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:1560
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tScAsIAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:800
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqogIQYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:1968
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                PID:3064
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FGQUQEgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIkwsYgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:1916
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\WkkoIIwQ\LSsQEEYI.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\WkkoIIwQ\LSsQEEYI.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\wOEUcUkY\UMUAQkIA.exe
                                                                                                                                                                                                                                                                                                                    C:\ProgramData\wOEUcUkY\UMUAQkIA.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\jkAgEIsY\RmkcMIMA.exe
                                                                                                                                                                                                                                                                                                                    C:\ProgramData\jkAgEIsY\RmkcMIMA.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1308

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                        Visual Basic

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.005

                                                                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        biUo.txt
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\biUo.txt
                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cb274292bb2d20c1cede1cf4ab8673f837e063b7c21176d6d6bcd2255548ab40
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e94ea06950129161b6b7b985c8bdfc5cc599c3a0d4c18fd041e5d984a296dc87
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5b4fe533022c37217e8453c3bd04c5b914b111fa68dba22a69600b2f80893347
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 996c9d47e86ac3528f0276932550ca357c75c11647e5f8e35cf512c88b31a4fb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ef14eaa14e47c18ef9c7c26197cc1fbe0d0b9071d6b00a87f1dad2a140125212
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bbebb9442777c53351f52118d4c86a4b1b93826a4744354ad647ad4ea449507f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 218d4ad178fb311cee2b0dc5265ffbefb923152f72639943f7f5c8f34526b569
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b912e35819758dbed7d747abd67f9779488a5e53274124f5d0d9f850baaa864f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 eaab2cc5490069b025593ba7f54bc539a4dec83bd5ee022f38afb9421d63419d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8837efde084a66f7254a2ecb6f872f94d069455ea287f934e8f051a583e05185
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 07357081c742ffd821b1e360780ca6dbfacd057e198c33b8ada11aa9a38971b8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cfe6e4d2f5795e4d3e54d01b628a05edcce95be007ee4a2227b9bb7ad94035c3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 514f0e0387acab3756f46c7042a8f6b6ec0c40c6b1e27d41ab9590729665a149
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 df0b72f8b9ec5e69f9decc6c000973cc130f3944b624319f685cefec54e73e0a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 39a73a197d2ed60577bcf13a117b389eebe318b46a7725bd04256de7538d2a7e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 005611bd4b9bf6f256681016a6d08d835f7108d8151dabfbd02df01f3675f948
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8eaa89eb74b4f5baab806f0c009af87a297091874421f4ed5eaca14ce76b2464
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 aff0247fba970324e334cf7d130fe5310bdf217e98da40c7d1f6ad5a24fbc7fd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 365347080e1cad67280a43577c270f1eb98271b26ccdbc2bdb7701335b50a98c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3f1ae5783ab43e718cb2820d57f4a7f49db5c16be722fa7e50542b8c8edb0427
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b8cdb66101502b365af34b792710f0eb5161b49c5b0285425660e457ccd38358
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 add836683aa1335936b9a65c4c608c48eeff1c88654f48eaaf0c652a06f1ed43
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cd078bfb80fb93c8adf52badf32aa0a9015a645112acdff3f730c071feb7b6eb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 a9fc0fa9e775637a310e6c9d3cd026afae4157f5e1c6ca141695d23dd10218ae
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 317722d41ace2f79bce0af6cb631b18ddf77f39bb663672f45694f1a92f76f72
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b4035f93a44685178f71c558d3f94ff0bb2da45307922f3623c465756b2c9eb7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ae4b6cdbe3fbddbaf2752771f6fe3c10eee2fef1fdbf2a57af4b5fa640237b96
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ad172d167d422e300774595375a499f939c0c3fa71b11801123cc9d7eed40913
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4be54f75c017c0dbaf47dff5520bcee3642061a8c063579492497bb7f70d74c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b0c3ad71f4bfa0b0a6383b0c4bbdab9a532946f69e465f4aff34b4edc918474c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bd9aca217da536046346afe7f1544f8b61dcba1f21532eeadcde13451d52bd94
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8db657e6f273cf52bed1f7b1b51d093fc4263d5db44b29128f649cd15feadfe7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 25c45d0fe649f5485c0edfc3a96e73ea21848d0d9da4fd9a41c392778c812f22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 fed3deab91b716efaa1cba9c60d8bc7ea1dc2dffb5e2897f88e46c81c7ab9f5c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9e5a43847fb32ddd04cea2db6f2b07e1b83e9ad8c5014f3cc28352ffa228f841
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 562512e6fca678dd7501705b8f8a841208fffa0bcbf6648678ea0e936a73534b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 85a4578aa9ddea96e33a44bdae4fda4c25807cabb412c062e69ec9b2438e6466
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bb3c9ee0371e803e5e2bc841efbf4c49b3266075d9f558eacf68025979eec85c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f637a22657bdfffa2e731f4ec86d55f12b98230ed5ab4e8e2fd47e0f0bacd8ca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0e15555c473e0ea18e86f17c8ec74deab6ba1005a8ffc575dd073fa65a32aaf8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f04b9c159de86cc0b4103ee6a8414ef0cabca0c26e0b3b9b9168c5912fbc4ae2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f9c986f6429789b1ec2b8ace749b6afd5c137a1d77aba1102002185f3aec56ec
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 423a4c04c0a0218aa651e339b9b49aec24c7d2a0d122ef6184b4f5e2eae99bb4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1025b25f0c4c0b98170cf36f93157b83bed69f5f502c23f920388d9697655966
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e66a217fdd6640f24620b19575061e990ac78a1d911072255ff275b8a9b12c24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 dc0394f04f4de20e75f380ed79390909c29c9a0cf6ec06b173f7a48ba7288a16
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8d549f016a1b341e399ead2bebcfc48c094b23c9e19aa7009c80d9473a3af660
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\jkAgEIsY\RmkcMIMA.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9ebbd2233db8a15e8337ab05d5dada56233850e37caf7ef200eee4957bb776bd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UMUAQkIA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\wOEUcUkY\UMUAQkIA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1acbcbc3515180c3db93f9408687713d9b733b663c7e2e507231814c4dcad994
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_81ef5b94942533bda42c5e25219f41bf_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AQAY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AQAY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fb4445f1aaf167fe80d784ec826751a75eb721134dd3504f88add3b922abb6de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AYUk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AYUk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 556402004c27e2ef8d6cef7982f4214c16ad20e98e0497077e6adfcd5116fe96
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Acwi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Acwi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0ca96231ff294cecc433bfd3a3294b88f36293c430821a212d31f49bfd1f0661
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Aowm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Aowm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 39e24b354fb30a7a19cef6ff8013de24eaf95762631b9ccdaa9f1fcae406ed2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AwQO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\AwQO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d18b7a4d9679e019fb95036a47db73545ea38167bc609cb054381e6168016d4b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CEMK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CEMK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 541acc2493271cf933d399d281c0bf6de26715f7de997e2ae502634fe6bbeb45
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CMcc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CMcc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b5e0ad8cfc9ae9f0d805b611697c0e7b150b844e71620140704716b5b25abb52
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CQYu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CQYu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4d7cb12622fd19cea420afc945c186f39a4c1ceb7d05c970ae8b0c3ad8ac0441
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CUMc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CUMc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4af0fff1ae0824a2232ec326bb9e045521859562c386a401b445244882fcfb88
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CYoe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CYoe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 af658d58b69a1181e9063176dee2159792df31b1f98386190ef2548c4c11ef2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CgoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CgoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5812456e674ce6400839584da9e5528d87202354c21d21cdbe8aadf0cb9e863b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CwsG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CwsG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b4b7b4b26787e57dca267148cfd9eb21803d2c2bc8897429d4eb131b915973d5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EcYc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EcYc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 83072b2efe10dbb7c0bf45cd7e4badc792e2856dac051ee1d02f962f682110a5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EcsA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\EcsA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GAUS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GAUS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d7db707bdcc2af249b64ac67375e486fd52f4fda6aeaa5018b48181866bfcb8b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GEIQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GEIQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4d22d90b4c0b8aa6495565f871bca4cdc39be1cb010936481f01ee53f6eb9a63
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GEQW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GEQW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b8baa3849dc728721feae7fae9377b21e1c4ad1f7c44bb1c8e614b9d6c79cf0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GQEu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GQEu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 553e4609061a720f6631b372787ce705c95068ecf4b04eeac1a090d657631155
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GYgi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GYgi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 79963aa7aeea53bf4275e4e071f328caabb5334a1d5c71b81027eea8b1bf48d8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GkEG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GkEG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 85fe059b3f589971c2da3fd2c4b9cafc3ea8ccfab08e64b26aed1a153950f367
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Gkgc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Gkgc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b8892b5bc8c40c067bfcdbfcababa03669ec5a043e8d62afdb6514ded7b7902c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IAMY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IAMY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f7877fd3dffa7fe315c80ff259fec949230a7e8b4f66c4fe27366f68a1e3641d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IUIc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IUIc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f7ebc8c9e70746c3c423ce400f3d065200603392dfa41aba0731aa907481f34c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IuQg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IuQg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IwAY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IwAY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7cb77cbbbbba47b235b484d52a19c7c78b059e0482f708004a21abf48fd600cb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KYgM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KYgM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 41299995981a4823f388d57e9ce6c757885ff8562f0acc1cc543ec114bd9ce6d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KcEQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KcEQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 36d456d0fdc5e270d2de8a660faee57ae252e66a5ce9f4e6667d75aa05334fc9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Kcwe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Kcwe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 93cb0ca2fe3149e5c805d21ec9b666cdbb74613c0d4642b03426e16d9e9c1aa8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KowO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KowO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 55e801f1f833a5aef17446f9a5fb1cfbe1012c664abadf4a20a84093c8fadf8a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Kscm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Kscm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a29b342a0b926a0b284a1bee7b1f87b8ad656e02e48e11b4eaada4ce62bbd01e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Ksoc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Ksoc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bade580700b77e361e8c3aedea6464dcdef1c7973ab09c6f16a995cc69f2d261
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MIAi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MIAi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5ef2da0e8470d935f61a449ec67994433ac8afd95153e1c2ae1ae1210bb1e8fd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MUYC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MUYC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 20333be0822223bb6130d1f831ab131cf1d92f463a9a7aca0132e272d2551c22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Mcgq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Mcgq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7bd6eb258dd9b47951774a687f7da809b78b244437f2c0011a1f66a3982c4ed5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OIsK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OIsK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bbaa75122b5ca773f2f35fd3b04c8bb44db956bac743de28b4ecc66560a956fb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OYgg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OYgg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1ca1c3610d5e1f82d64a93b25fc4342028e2c1f325c3c5e7e3ec46f2775c075e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OkUA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OkUA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b8771970749b4094dd174017a55b177dbd95b2534f126ca5bd0966f9e715b679
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OoEy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OoEy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 db533a3d7aa75f81d44e05c85b567719a6701e595bf5b294562d686ae7d33561
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Ooce.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Ooce.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1a4eed9a08d00339e44c3e2b98820bf8c9f29c0574b8b935a64b030be808f328
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OokA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OokA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 87a3b7dded564d0772d0d2e1c336df108cf780f5ebfb195c68570077f9d57032
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OssI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OssI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e06aecf400998385b899defd5aca3bb7972da87fc5277ec551340502c2b78a97
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OwQI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\OwQI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0a2d5235b5553476f8db59064f971ee68f8fd5461102aebbd50cbdfe2e4ebc8a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QEcQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QEcQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 287d6550185939a131ee6777ea6e4c7aa5bfc0b23c06f58e29d547c7687f522a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QYEU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QYEU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6d93cc81a47cb0ce157305703b1859b9b37ac8c6a70f129d2b6a3f09293685fa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QcQk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QcQk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 78e5be71d57b5a725176193f038c317d0f3176d59abadb75da3f918503fbaa56
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QgYi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QgYi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cf04218842db110bb75f1f0c175863f1d191f591689c439e0fa3cde4779c49b8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QkQm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QkQm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 af0d17a36f7fe97843c092e7e3c1b0ee21d18c9e510b02b9f73c82c9c4f319ca
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QwIu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\QwIu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6554915da1c77188deb844d207cf73b52d5dd8247da29ad8c3e4fce52cbc2125
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SIkwsYgc.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SIkwsYgc.bat
                                                                                                                                                                                                                                                                                                                        • Size 112B
                                                                                                                                                                                                                                                                                                                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SMIS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SMIS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fa245d43bcfed4ad0dd8d4b6ebe0df41d49231e8c54975ad62cbd0cb01ea15e0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SOYk.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SOYk.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UAMU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UAMU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 51d0315f7b35c0f16e58aa052b067364bb712efc4afcbad11a3be084059b48d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UcIK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UcIK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b78c1b54edd84b91ea6995bab1af24bd76eff2d22d132a6c346e5dacc526759c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UoQY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\UoQY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c1690aaf484e7ce03ca0a4de1873007c00e58589ce7f6639c4382f3a48674d8a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WAsU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WAsU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c33ff4ee7cc9828139835aa067acdd368aaa1d87b9dad6e893f7a45545a074d9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WEsq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WEsq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cffc49dec024874dc4052f9b6cade7d3307cf75786b2d8ec8d5651e61b93c630
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WIsM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WIsM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5a01f75cf333bdb4a05d60f8c0cbec1be7ae07768f921cbb931af2fa34256730
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WQkk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WQkk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 027a0a44baa9317cd25f8b234eb8bb245a6a444421a22c60db9060e5df8fe0f6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WUks.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WUks.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f37f2acdf661dae4dbe63e9953f97130ad6bd94f8847b6d0ab9483b0254c35d8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WYoW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WYoW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dc8be55093d05a31d7ef05ed4537a44f455fe9c579d8d3d591652ee0b7d00677
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WgUg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WgUg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WggU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WggU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8bf19dcae6313d858a8a9dc1aaab89278465e6c7cdccd487c0ef37640ba3740f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WsUO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WsUO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 83792dd23fcad39a669565b944d5091db40745d4312fb3af703c3e5f6d5f876a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WsUw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WsUw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8f1367b43234795f851d5264a27aad4bece0256a026b52890526d83f8618dcd4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WskE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WskE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 200fe833e8f8cc032fa1494c3f677f5f69b6bb37594b63135889483b7fa9b047
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WwMe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WwMe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 081a5e97ba9bdb5578291976d5e45704b8d7d1523089251fbfe89fc922f25ced
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YEse.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YEse.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8cf37995ab0e380ab09fd93056d9577f0b34585d82a27c9e0dafb0115b173c76
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YEsw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YEsw.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 35841427d41c60564e42ac27131222a2a16c9e51385e10d303910de77f97a68b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YMUg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YMUg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 db4400b2c8f2f09f29cda75e9171b5c64e5c0e70739e2c9527238d4b3402399b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YQUM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YQUM.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c0de87b7a21ea4a35deb9286d62bb820c4dab00ccae00a9744e7365069023494
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YYws.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YYws.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 724ba5617e2325f8331b3d54f5b69de8a8de4678bab3e155592e9b797d791163
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YcQG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YcQG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d4bb9e36f010ac21680b7bc39e224669766b11a624593ffc8dcd751bb73c50d9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YkMu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YkMu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bd1e067f52c5e42d9066ca5b15a3712b1004b2e470515ff55317b1206c3c0144
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Ykce.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Ykce.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9490817c8a2b5107464c6db71508392ac0782ddbe3a506a032c3f7341b9b35a8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YuUM.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YuUM.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YwYC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YwYC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c9da59c89ce6d2f31e41363a44f7cf7eeee62a3dae2813e4954b81f2d0121dcb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YwwO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YwwO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0ac70f15a55f75b7648570d36667dfd48b37d7408c81d7cfe372952859936034
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aEYq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aEYq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 54486b74463a3a01ecd7bd1b0c6dc823acee2dbfaea357010881d54551f8914b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aQoC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aQoC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ef42647e4e9b6e3b724a4be4c6cf11e597841794db52c99d5af446a0197f4b52
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aUMQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aUMQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 05eb8b28910d4d9d4b09b420874349411c4b3d7a961afa6df1acf19d5ac252e3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        agAO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\agAO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 33fa519a7eefb8afe6fe6655a3f6cc74aadc3e29d85a0b3c5c6c9d1626ee3481
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cAIm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cAIm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 28324dd04b33e1f8504892cece25b14fa25d73ebc741a8b4344025626a378831
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cAUE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cAUE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 00cad43f21d084d0b9b45154c592f7e025f77b147159caab0014362a30d8971d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cAUE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cAUE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 be2df6bfc42aa0a0cd42cf6c78c177b657b84d5fcdbdaca398f08efbd703068a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cEEi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cEEi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9bcbadfcbd1a56b913a84c9af916565fb5135d4d70f15c2e0c5c4a0f5896baae
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cEQY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cEQY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a8d0529e016c4736b708f6228c748820495d61af40d8d61b6e85662871e85aa2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cMAU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cMAU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f246cef377cd4f668be2b9ed03714877db588a7e05b59eb1559c7575f05fecd8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cMUa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cMUa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 875d9606267a7dc12bd958c2384fedd06de205bf72be2b51525d2a9ed63185a2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cskU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\cskU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 20c02905893f5466b59a5814d0cf1b28a5b18f19b7120367582c695e763fdd0e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eEAK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eEAK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7b3355947b0a8e5d0ac24d0d41c4198ec43e54c7cfa49fede23f961bbeff2d2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eIEA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eIEA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dc0f4daf7848aa736eab55295afc314d218fc5b296e361e3abc57169bd052c35
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eYUE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eYUE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e10b8cb4ccb5ffb3e830d9b598dc6c5a37200c11988c103be5028dbc31d206ac
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eYUw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eYUw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1566a91844856ba0ed5d7bbc8b3be68e5ffbb8305af37174f0d24f42f767473f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eocM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eocM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6edff414bdb6bd0b7e1ca5dfb7ec43956be52b3d9c682c792da67e7d4047eb2c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        file.vbs
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                        • Size 19B
                                                                                                                                                                                                                                                                                                                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gAsi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gAsi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 85d9b12c87e59e2a3ea784ad0ea2003be4121a1ee6345e8042f80960ac9ed098
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gIoq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gIoq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fd54b95eb98f7fb147842d0c31dc23f3d7d0a3b407b3b9dcd5cf1c9bd6e9f99a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gYsm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gYsm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e1d513df7fde84611231365702b422a51c1da88c20e7beec65e4688de79b784f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gggS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gggS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 055c2c3c836db9f8e444284771e5d6f96a7bbae5dcdc37929b262f7dd9162783
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gkUA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gkUA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9d52c184b412546854fc18ba183d1fde3d45b8ac5267fd678ab3a7654189441e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gkkk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\gkkk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 069fb31b386cefe6e260d4a7b4def5dd01f70c976b5aedf77aa8d66a0bfcb8ac
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iQEI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iQEI.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1857f6960c050821f1a1c5d583889f56ec717122bd6d37b844b9e65c593d5f01
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iUog.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iUog.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3c43dcb7586ae7a3fa84e514655ac28c5d64843ec51f123b2586fead910bb871
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iWcU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iWcU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iYUm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iYUm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 48009bec4eec529f945713ab00a37800077c0ee1d42d549988183d480567f04c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ieMA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ieMA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        igcq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\igcq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7dd91e4969f439c3815150da9288627f40bd690fca14432a543f9ffc04b3baff
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCgc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kCgc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kgos.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kgos.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d76c2fc18ab9e9c3d24c2cee4de69f2b74c55f2a6be28907e542a5852a5f6bc5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        koUu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\koUu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4897d472625406f299d7183f73b606d94d96bb9ccb612ceab242d025d0d9d675
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kwIQ.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kwIQ.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mAEO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mAEO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e2e77e5aead151e7a02c637b92ac2e881b7a30204b1c1ddfe62f26a3e490aae9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mAkg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mAkg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 81080bf34f7ba2fab57826e941ab27ef5a4331aecadaaeaf7263ef190de26128
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mEgQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mEgQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b4c73cac487b0527f2777e46b25aee1dd4b9584d389cc5b5767e1c0007d8bf90
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mQEa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mQEa.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dbf24e3bf62142f24f7c388e424d7a376cdd75abed5e325ea921b8379caf4b9e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mSoQ.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mSoQ.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mWkE.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mWkE.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mYIw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mYIw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7d3b5eed418d94c3a13ce5ad2222fcd4e1881fe748cbc791d98f0dd0f3f86e25
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mcAe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mcAe.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 995e8ec697a3bea5a4aefd9eff39ad66001b919c462f820f3a987c4804ba698e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        meEw.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\meEw.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mkIk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mkIk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ea49628659b598f1dd3048f6c49e2a41ea0cf2e7c7c4896a9fdfeaa00d0cec74
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mkUq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mkUq.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4650503a7c1b704e702d72d0610fae9c993b91ced99992fac001a3612b6f4aae
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oMIc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oMIc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oMYO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oMYO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e133e4737fa5859a946b1a62d41bf3aa1e78ea8f21261617aeaebddf2dc008c3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ocwA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ocwA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        okkE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\okkE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d57a0f8b365a1077b0f2acd681a20852453ad2f140eb7ccae249d0a6f6c89543
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        owYi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\owYi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d47d5f61fd1d268f1973ec3cf8bb504407112cc8f3cb14166bd13bf3b4a74585
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qAsM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qAsM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 74e66d4d5ff519efc62d4c6b04b28dcf6854fb0e90c828653533a92a1c297f73
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qEgg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qEgg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b3825876f1cf2f0de9bd3a15fce510257b78d51d41abc539302a9e85ed2d0ba9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qIEc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qIEc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 223f59ef635248796dc6942cbedfe53e45c550207eef83ad97c34e0b1011e0fd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qIgm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qIgm.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6755523ba2ca6b90c9272d3da5bd33d9a2d057e5d25b4b093e5c1f2dfe2e603d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qMku.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qMku.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 445689e43bdebac3dcc1ddc0a064cf722345e5662dbe74c2621b74e0cada42c1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qYMy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qYMy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 589b204366bc6bb774c441b43cf2f4686a91b05be348ac82c406fbcf9b119daa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qYkY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qYkY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 083030fb227a0f525455173d3d238f4b02b0ec33ea3c9280878050d1935f8cc8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qYwi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qYwi.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 804bdd3f80573664e843cafce9059fa88cc453fd23c6601d67a91b11c3f3e308
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qcsE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qcsE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a6d79f4cf8443e54269f6b8c4c1e5b594a2e418ad1a601299e7b2923a94547a1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qsAE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qsAE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d6583f796357253365ce81d6d0a31909ac113891d610594cb8b960395b0c249a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qsIU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qsIU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 47bd9771e21361e3cdbb480cff3b5b3edf2e62e630e38d47e53861f509c74639
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qscU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\qscU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bc55359fcee8945d3aa137a40ac5ed57a51563cd1aa828051f0a60ab4a1e8edd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sAYc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sAYc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f50c09a1fd483f71048cab7800ea29f428887ebab2944c2dea300eb15707e0c4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sAgW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sAgW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3e7e70f3a520a002963cfc0398f6d17a99edb38a45cb4a0bef616f0e7449c2f4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sCIU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sCIU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sIMk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sIMk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ffecaa1803fd71f7c0af1f514166c7b6ed069cb582036e99a9ba2094a9ffebd7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sIwM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sIwM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bcaad791116d924cd89714f8f6a1a931fe4a616939adaafcf0021c33ae50707d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sQMW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sQMW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d308a8d9cf97de4d6eeeca4f1b8d777ee4c2cc25d41a813f59c8b49e8c89c003
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        skQo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\skQo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 af5705c43e7d52750e1ce35cabe418199be2f0796cfe558eee64d2f74275d3a2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        skUw.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\skUw.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sksQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\sksQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f718a3c89252f4f6657ab80c4f316fdeb3c7afdf089604783c03b6e7ef79eb57
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ssUy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ssUy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7f7dfbe90748f386f102bf64798ce0e5243514cfc64358b525760bd281787822
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ucsW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ucsW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 983df507c359c0a09ff1efd29d3fedc773f2e4b4d428accb086912275b8c3c77
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ukwq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ukwq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7a937b2dcf82d56936fe608a027bc3f13d275c30306e397e68b9db58b7ca2845
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uwYy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\uwYy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 48c8a8e0ce2111510167a6a0c45980ace91561e7ed8aace5028bce2f5a22a608
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uwow.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\uwow.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c68d40f1adfd6803569a15402b2e1a235b6eecc3b1e802d82276750f11147c8c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wEEe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wEEe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b3dfbfbe45050d4fcc910e3971a24b9d0886494ae0c2f9fced420668e1d228c9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQgQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wQgQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e325951d9fb0a0a73c03238dd20d9587f8c24de7788f6dbb12a93bb8aff99716
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wiQU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wiQU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wkMs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wkMs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8df8f247402f0242e031a5c1ca1674ecc17cc3a42def4347532c92c4f0921d56
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wkkS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wkkS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c720b60ef432303d453e45c2f8cbd99e720000127bed028678dcc1e67448195e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wsYS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wsYS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c77d580d717250594626ae047237db25c7300b54abfc21507649db19ea999723
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yIIa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yIIa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 029b03460f2fabba719c5b0a680c4d4248a789dd5ab0e2d86bde95da5d6b1041
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMou.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yMou.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b7de4f42b4da997fed34ca1d093134ad1faab62415792309acf46cb9f2535495
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yUYg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yUYg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7679c14349eb061fef13bc8e565912b594f77899bf3a10994d10c177e0ea554a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yUkI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\yUkI.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 eb3317cec22a846928884e6dc3bd1b9e6ecc2f13df5355d92634d0d362c36a10
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ycAy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ycAy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 906abbacfc45398ee11d355647e73fc4721847837be74230954f9e3169b02ca5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ykIG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ykIG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fa976bc3428d327649042d75690fb2a5fa789966be7d801878be59890bc1781d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ykgO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ykgO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e7f53467d31906f88ca27144fc9f12b72a8f2c2077f781f3fd095bbef6a464aa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ysQa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ysQa.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3145cc1c9cfffa5e289741a922e2adddd455f4037db4ff36d75d847ad7d96700
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d954edd70b436fee7d9843edbaa4d531f53547dcbd765a55c738b989bd0d6fa1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 73e72a728e4dc9e70c1fbc7d4b90bfe050d869c600541530cd689e45c2e2f6c5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5a4697aa09baaa92db0b7dc4b478bab8a356e96940fea69b38aa2f0ced720425
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 7808e5f23fc8e8c1b171beef4878007de84cf6ff06171778b9056811b78470a5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f8a8b1acbf8d56beec009aaa7688d9271d016249ba4137d399a0a5ee8ba18cde
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3e7f10f8c1255ecfae3a53b63632d7c3c901207fdaffaf7344cdf13eb94bfbaf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 90cb05ab3355cdf17e3997fc0eac60b4fdd14c37220e1c054f45eb48aff2f2aa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ce29eab89ed2c01369ff371e58032fb9c12894ff35401a1fd1ef271c56aa23de
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1950096491aefab3c04840e543fca8a6cf27149e325f6551587a418fc8b18044
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 17a337abf00bea46b36cd6371a8157d80f1937e2157243f9c114cbb917e6dcf1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 576e67768535dd4d40b9f066fc05fb033b81750bae7ccee1ee9e51c286eb50f1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1b4c708f03c034d26b37b6196e1f741580a7f3dab6cf2a17c90cb88196c151db
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b5263f4cbdd3d75b043029e431c8b346f49502539b74b1d69d3163f4b32a1a05
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 75c6c05bf6d9a014e89e1ccee8b599db8c98832a1358cb5574fcacc2f2595b7a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 069605f0c56b0dee65ec31336748618b0d0447533ad8e90b1411cad93fdf6168
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9863538efe670f45586e39989d538d6649795d649b5897093a7598b470911495
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 dbe76a08529bf8ddf13e85bfa2e23ff3ec67d4520b709ae3d73e7e87cfc4803f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b45668de22e7baaad657092cc1e4faf4391d03afa125a2d2d92451f5f038ed87
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 29e75f6d7d4ce280d9665e91ee8e458d4f9d2008047274f364dcb60a0c870041
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6c725063c8c89d8882fb620b3383e2942c7dcebb8eaaeceba008371b1be9cdf7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ba299be78684a9a6a70c6e265483117575b1ef660a5deb7e5ae37aaf6b699157
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 02bee14cab592420d06ea80a907d9fa685fef988a667cab4748e1d8b3539231d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d4822c5471ff65d96018a593cfd13d271dbf95a0558f36763bbb2a5b5fe1efe6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c858f9064161863663176e6afc3233e1129f7004312e378ac04df02889935329
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 87372bef989d77b74e02d860f1aeadea57f96bf305311a92b3fccdf485b01622
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5352c111ff5e36230629009e8865c603fac1c49b06104033e62c5825b28a5256
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c178d054497a86ea265163f39ae01bcb0b057509109782afe519bbd79539f0a4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 08aa5547f1f1a227dd3651cb3417565a4ab7f4c175c5765a49e4db11f156c891
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3c66b8e1d42f5c0d74838e9ce2ed8f2ab91f147bafe9c656bd44d8f569afa28d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 879c5a57cf83cf892518428799bb194718ed2480e48beaa757c272de56a92e86
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b05150e97b8fa8e68af6d7544bf0d19b30526a2dbf1e44d5e50345c8cde661dd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 56e8f02d142545987069f0cdb03ba40851f126e58ffde13a821313b2942e2ee5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ade3ddccb7720d50ad8c80d3b6c857f7fc4013e1afe70c77004dbbc68397dc2f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d154033b1379b6575b8aed11f612806814016dbfefcf31084fefe99369e52cba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 d1d21390043530995758ea766935d7f81afec6cd891f2457f70f9fce725c3a3c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 be3ebe3444663f0505e608ea4d842b01da46ff3583bb30e6584ddbe463f2ccef
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 71ea9e2f09606247102c27e58656de110934304849e54568e3bb0f913c551941
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0d98eba511ae245a3dc8937adac60ea8fd2d978c787ca10b65dead2438d35b7a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 cd62a67516dece5f1123e20bc19329e89f9e86fa2c6f9c1528942c33610374dc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e442c27c9549051b5cd90e58c06a0950221d5c3d9e07db0c943da2b8f6b293b9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f8ba1220cfba5af2ea771d31206095ef96d1f72c525f6141d2857a6103cd79f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0baaa5c7ab5cc55abcb13624a4eca8f86c3284f41ed403e9534832c7f48f3a31
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 6ee42e0903dfe88190c5ea40eb3609bc52ca56b470c3e84aa245e7303d3f4437
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ac32d6639c9b496df18c2f83bced99a54f6fccba656a9cb7a45c302d41450dc6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8bdce7243d8cac81459c7c1e3e79961fc918a827533aff6777885dbdd12c53ec
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1a64ab0cf66f8491886223975dd335b3511feddfb3c4b005a1abfb830729c91b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1ca9d6bb7442cff902816383e419e80deefa6945ca407a58c5fe923119fc8ed3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 e3a1418adfc19a0b0981fd254ea2e01994aba5e865973d22ab2b6f21360a5cbb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 1185f5ce7c5b04b97ae44cc27249197989afe00759f1d4b9f8b8f46f3d101604
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 4e3cf9be97a36cb32ecc955d3bc81e2573f97184b630f932934405f06d574ce0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 274b700d82b2d592614e96c49299533176db36bb7bb4cb4ceec1fc668eeb3e1b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 963ff6c837909e21767e0d440b1df4f11900c7835c0563a0c67cd181bb8bc3f2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c315a8b1eea40baa5201538da6d1094c753470962fb617a27905514f80b948d9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 26852f0d11d837ffb5012637412e83bc4d90580da314b33af8142cfe396f669a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 efddad0fd0459e59a3873feaa8725060a7043c3c5105013de73c970451f95c40
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 101e38983658d939176290690a4972e363f8086986423b3eec94b2eae840335e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 65cf67faf4737b8871e665712454c7e37d6fc2eaae2499109b4c3354e8aae7db
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 21e0b93bd801b9df54792791fbd5d5547b7fe8b49f1a0ca5ea67e31667bffec6
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 19ec1e192b25f500cc9397b55ff16e49f486b4b025fbf5188109acfcc0df393a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b6da7e5c293457320e7afad380530194505e51fa3e29eee4f44e3e5cf36ccd44
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 55915bf4f718bf2e022034ced89e64dcc09e573796a47833253464aff31b32c0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 9167456c34b2437a6f8408f69682c7796f22c6e291af9983223bf7a4e6e0255e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 66a6f604cc96d7345576a2be32bc94c3fde83b73443a0d426550657f39d0396c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 bf4ef4f377095d3a4bc180b616c2e679f700e1d6a28ebc990f5780951dcde2c2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 985c4ac8dd7548dbe9a85b27552e870eb27aaeaa4d36a07d4cea1dbe57e63617
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c5da992a76cb8f8ba148020879557b13bde9ef7912883c8a4dfe4495160eff2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 46214796ef91300692e39e8b2c2ffb65f81c0e6729954cc441243c06ee5b83df
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 af4a7958cd611a39baf046a14b4bee86ce598dbc5272776ffd91b8c74cb38c5c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 af092ba1eb5d558291f929ff4ec1c824df17104d73cd1376c3213d3e0785596d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 20b82ffe80980e02e05c7460c112fc19478952c7f18b28d02aef6beefad24177
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 8bcc19040653c987896a84232a1a1ab9851aa6b0225e41399d84de4ae767b44e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b4f4d7c3c9b47168d10e1fc7b958154f82b2d097ca6957a5d69bc2dca42b2077
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c81136b8a35913e440810834d945b695ecc7dab782bc3fde8352845e89ace4f9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0c7d5755f30769a07c561b3e95ab9139cf6e822510eba708a58af9ba866d84e7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 85588b1a98b62d13f461a1d836ad57efbe3e278b441e987ccfa04b790cf21115
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 b98f4c6a66d14c8064a6c19e59c31674009591579bea8fb2e6757f20d18d5b3f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 693f514285779178845472da7e34b94b99d91edcc93c5eda1a8dedfd54e4d879
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 911fbd360d1b1902a330e1b51c3e3de370f88284826c14eace47b3932ce08226
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 54ecfddf5c91a29b36a86ae0cb9613c48317ee62a776e69b15535c349ed0ba9b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0f420fe174a66cb27866448a373f146d7e101c8934965d4374afb6e59275f776
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 5a7c13b6aea39246f4be5c1f349d08bde11339f6bdff16910b5e091e227edafb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\WkkoIIwQ\LSsQEEYI.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 0dc8ed1fe236e6987cd4124fff04c15be924dcba55753b0ef004ac5e9c5406a3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        memory/124-2083-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/400-280-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/756-66-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/856-1965-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/868-2164-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1000-24-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1000-2437-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1044-211-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1128-2227-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1128-2214-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1164-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1164-2422-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1308-2447-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1420-2277-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1544-2195-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1620-2028-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1704-2177-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1812-2218-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1828-35-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1828-36-0x0000000000A50000-0x0000000000A70000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1828-3-0x0000000000A50000-0x0000000000A70000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1828-0-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1872-301-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2000-2123-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2060-2268-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2160-225-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2344-2321-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2424-2204-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2432-2001-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2472-2237-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2528-2299-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2700-53-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2724-1993-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2724-2010-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2972-2132-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3084-2114-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3184-78-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3348-2042-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3416-197-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3436-256-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3448-181-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3688-2259-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3760-2233-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3760-2250-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3780-340-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3900-269-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3984-166-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4264-2092-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4264-2079-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4332-122-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4340-2101-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4380-1987-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4600-108-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4680-1947-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4696-2060-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4832-2432-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4880-2186-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4884-2051-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4884-2038-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5056-2146-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5132-1978-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5140-236-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5152-137-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5256-1956-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5468-246-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5576-96-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5592-133-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5592-153-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5648-2019-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5872-2073-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5888-2427-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5888-18-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6048-2290-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6084-2155-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6084-2142-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6112-2308-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download